clay-server 4.3.0-beta.5 → 4.3.0-beta.6

package/lib/project-session-pair.js

@@ -1,45 +1,38 @@
-var pairMcp = require("./session-pair-mcp-server"), pairPrompts = require("./session-pair-prompts"); var { attachPairFactory } = require("./session-pair-factory"), { attachPairLifecycle } = require("./project-pair-lifecycle"), { attachPairTurnControl } = require("./session-pair-turn-control");
-var driverEligibility = require("./session-driver-eligibility"), driverOrchestration = require("./session-driver-orchestration"), { attachWorkerPermission } = require("./project-worker-permission"), { attachWorkerProposal } = require("./project-worker-proposal");
+var pairMcp = require("./session-pair-mcp-server"); var { attachPairFactory } = require("./session-pair-factory"), { attachPairLifecycle } = require("./project-pair-lifecycle"), { attachPairTurnControl } = require("./session-pair-turn-control");
+var driverEligibility = require("./session-driver-eligibility"), { attachWorkerPermission } = require("./project-worker-permission"), { attachWorkerProposal } = require("./project-worker-proposal");
+var attachSessionPairPrompt = require("./project-session-pair-prompt").attachSessionPairPrompt;
+var attachPairCloseTransaction = require("./project-pair-close-transaction").attachPairCloseTransaction;
 var { attachPairMessage } = require("./project-pair-message"), { attachPairTaskControl } = require("./project-pair-task-control"), stopAutonomous = require("./project-pair-autonomous-stop").stopAutonomousWork, stopOwned = require("./project-pair-owned-stop").stopOwnedPair;
 var pairHistory = require("./session-pair-history"), responseText = pairHistory.responseText, errorSince = pairHistory.errorSince, recentTurns = pairHistory.recentTurns, operationFingerprint = require("./session-pair-operation").fingerprint;
 var beginPairQuery = require("./session-pair-query-start").beginPairQuery, attachPairResultPipeline = require("./project-pair-result-pipeline").attachPairResultPipeline;
+var pairTarget = require("./session-pair-target"), splitRoles = require("./session-split-group-roles"), stopAllWorkers = require("./project-pair-global-stop").stopAllWorkers;
 function toolResult(value) { return Promise.resolve({ content: [{ type: "text", text: JSON.stringify(value) }] }); } function toolError(err) { return Promise.resolve({ content: [{ type: "text", text: "Error: " + (err.message || err) }], isError: true }); }
 function attachSessionPair(ctx) {
-  var sm = ctx.sm, store = ctx.splitStore, workerProposal, workerPermission, lifecycle, taskControl;
+  var sm = ctx.sm, store = ctx.splitStore, workerProposal, workerPermission, lifecycle, taskControl, closeTransaction;
   var turnControl = attachPairTurnControl({ sm: sm, splitStore: store }), resultCapture;
+  function targetOptions(options) { return Object.assign({}, options || {}, { multiWorkerFeature: ctx.multiWorkerFeature }); }
   function groupAndPartner(caller, missingPairMessage) {
+    var args = arguments[2];
+    var options = arguments[3];
     if (!caller) throw new Error("partner tools require a session-bound tool server");
     if (sm.sessions.get(caller.localId) !== caller) {
       throw new Error("this session is no longer live; the partner tools are bound to an exact session");
     }
     var group = store.groupForMember(caller.localId);
     if (!group) throw new Error(missingPairMessage || "this session is not in a split group");
-    if (group.pair && group.pair.driverId !== caller.localId) {
-      throw new Error("only the configured Driver can direct this pair");
-    }
-    var partnerId = group.members[0] === caller.localId ? group.members[1] : group.members[0];
-    var partner = sm.sessions.get(partnerId);
-    if (!partner) throw new Error("split partner session was not found");
-    if (caller.ownerId !== partner.ownerId) throw new Error("split partner access denied");
-    return { group: group, partner: partner };
+    return pairTarget.resolveGroupTarget(sm, group, caller, args, targetOptions(options));
   }
   function rolesFor(session) {
-    if (!session || sm.sessions.get(session.localId) !== session) return null;
-    var group = store.groupForMember(session.localId);
-    if (!group || !group.pair) return null;
-    var driver = sm.sessions.get(group.pair.driverId);
-    var worker = sm.sessions.get(group.pair.workerId);
-    if (!driver || !worker || driver.ownerId !== worker.ownerId) return null;
-    return { group: group, driver: driver, worker: worker };
+    return pairTarget.rolesFor(sm, store, session);
   }
   var pairMessage = attachPairMessage({
     sm: sm,
     getSdk: ctx.getSdk,
-    resolvePair: groupAndPartner,
+    resolvePair: function (caller, args) { return groupAndPartner(caller, null, args, { mutation: true }); },
     turnControl: turnControl,
   });
   taskControl = attachPairTaskControl({
-    sm: sm, resolvePair: groupAndPartner, rolesFor: rolesFor, turnControl: turnControl,
+    sm: sm, resolvePair: function (caller, args, options) { return groupAndPartner(caller, null, args, options); }, rolesFor: rolesFor, turnControl: turnControl,
     sendFollowup: function (args, caller) { return sendToPartner(args, caller); },
   });
   function broadcastDelegation(group, caller, partner, active) {
@@ -120,11 +113,13 @@ function attachSessionPair(ctx) {
     var token = partner && partner._pairDelegation;
     if (!token) return false;
     if (token._capturePending || token._captureComplete) return false;
+    if (!taskControl.matchesGeneration(partner, token)) return false;
     var group = store.groupForMember(partner.localId);
     if (!group || group.id !== token.groupId || group.members.indexOf(token.from) === -1) return false;
     var caller = sm.sessions.get(token.from);
     if (!caller || caller.ownerId !== partner.ownerId) return false;
-    if (group.pair && (group.pair.driverId !== caller.localId || group.pair.workerId !== partner.localId)) {
+    var liveRoles = splitRoles.resolveLiveRoles(sm, group);
+    if (group.pair && (!liveRoles || liveRoles.driver !== caller || liveRoles.workers.indexOf(partner) === -1)) {
       finishDelegation(group, caller, partner, token);
       return false;
     }
@@ -140,7 +135,8 @@ function attachSessionPair(ctx) {
       var deadline = Date.now() + timeoutSeconds * 1000;
       var timer = setInterval(function () {
         var currentGroup = store.groupForMember(caller.localId);
-        if (!currentGroup || currentGroup.id !== group.id || currentGroup.members.indexOf(partner.localId) === -1) {
+        var exactTarget = splitRoles.matchesLiveTarget(sm, currentGroup, caller, partner);
+        if (!currentGroup || currentGroup.id !== group.id || !exactTarget) {
           clearInterval(timer);
           finishDelegation(group, caller, partner, token);
           reject(new Error("the split group was dissolved while waiting for the partner"));
@@ -148,6 +144,7 @@ function attachSessionPair(ctx) {
         }
         if (!partner.isProcessing && !partner._queryStarting) {
           clearInterval(timer);
+          if (!taskControl.matchesGeneration(partner, token)) return reject(new Error("the delegated task no longer matches this Worker generation"));
           var failure = errorSince(partner.history || [], token.startIndex);
           var interrupted = !failure && !!partner._lastTurnInterrupted;
           var response = responseText(partner.history || [], token.startIndex);
@@ -182,18 +179,20 @@ function attachSessionPair(ctx) {
   function monitorPartner(group, caller, partner, token) {
     var timer = setInterval(function () {
       var currentGroup = store.groupForMember(caller.localId);
-      if (!currentGroup || currentGroup.id !== group.id || (!partner.isProcessing && !partner._queryStarting)) {
+      var exactTarget = splitRoles.matchesLiveTarget(sm, currentGroup, caller, partner);
+      if (!currentGroup || currentGroup.id !== group.id || !exactTarget || (!partner.isProcessing && !partner._queryStarting)) {
         clearInterval(timer);
-        if (currentGroup && currentGroup.id === group.id) handleTurnDone(partner);
+        if (currentGroup && currentGroup.id === group.id && exactTarget) handleTurnDone(partner);
         else finishDelegation(group, caller, partner, token);
       }
     }, 500);
+    if (timer && typeof timer.unref === "function") timer.unref();
   }
   async function sendToPartner(args, caller) {
     try {
       if (caller && caller._delegatedBy) throw new Error("delegated turns cannot delegate to another session");
       var resolved = groupAndPartner(caller,
-        "send_to_partner requires an exact existing Driver/Split Worker pair; call propose_worker while unpaired");
+        "send_to_partner requires an exact existing Driver/Split Worker pair; call propose_worker while unpaired", args, { mutation: true });
       var message = typeof args.message === "string" ? args.message.trim() : "";
       if (!message) throw new Error("message is required");
       turnControl.assertWorkerAction(caller);
@@ -248,6 +247,7 @@ function attachSessionPair(ctx) {
         return toolResult({ status: "running", partnerId: partner.localId, taskId: token.taskId, generation: token.generation, hint: "The completed result will be pushed back automatically. Use read_partner only for a requested status, concrete failure or stall diagnosis, or capacity/queue decision; do not poll routinely." });
       }
       if (!partner.isProcessing && !partner._queryStarting) {
+        if (!taskControl.matchesGeneration(partner, token)) return toolError(new Error("the delegated task no longer matches this Worker generation"));
         var immediateFailure = errorSince(partner.history || [], token.startIndex);
         var immediateResponse = responseText(partner.history || [], token.startIndex);
         var immediateOutcome = taskControl.complete(partner, caller, token, immediateFailure ? "failed" : "completed", immediateResponse, immediateFailure);
@@ -268,8 +268,9 @@ function attachSessionPair(ctx) {
       if (caller) {
         var group = store.groupForMember(caller.localId);
         if (group) {
-          var partnerId = group.members[0] === caller.localId ? group.members[1] : group.members[0];
-          var partner = sm.sessions.get(partnerId);
+          var failedRoles = splitRoles.resolveLiveRoles(sm, group);
+          var failedTarget = failedRoles && splitRoles.resolveWorkerTarget(failedRoles.role, args && args.workerId);
+          var partner = failedTarget && failedTarget.ok ? sm.sessions.get(failedTarget.workerId) : null;
           if (partner && partner._pairDelegation && partner._pairDelegation.from === caller.localId && !partner.isProcessing && !partner._pairDelegation._retainOnError) {
             finishDelegation(group, caller, partner, partner._pairDelegation);
           }
@@ -280,7 +281,7 @@ function attachSessionPair(ctx) {
   }
   function readPartner(args, caller) {
     try {
-      var resolved = groupAndPartner(caller);
+      var resolved = groupAndPartner(caller, null, args, { readOnly: true });
       var count = Number.isFinite(args.lastTurns) ? Math.floor(args.lastTurns) : 1;
       count = Math.max(0, Math.min(5, count));
       var payload = {
@@ -289,7 +290,7 @@ function attachSessionPair(ctx) {
         title: resolved.partner.title || "New Session",
         turns: count > 0 ? recentTurns(resolved.partner, count) : [],
       };
-      payload.capacity = lifecycle.optionalStatus(caller);
+      payload.capacity = lifecycle.optionalStatus(caller, args);
       return toolResult(payload);
     } catch (e) {
       return toolError(e);
@@ -297,7 +298,7 @@ function attachSessionPair(ctx) {
   }
   function interruptPartner(args, caller) {
     try {
-      var resolved = groupAndPartner(caller);
+      var resolved = groupAndPartner(caller, null, args, { mutation: true });
       var partner = resolved.partner;
       if (!partner.isProcessing && !partner._queryStarting) {
         return toolResult({ status: "idle", partnerId: partner.localId, title: partner.title || "New Session" });
@@ -310,43 +311,26 @@ function attachSessionPair(ctx) {
       return toolError(e);
     }
   }
+  function closeWorker(args, caller) {
+    return closeTransaction.close(args, caller);
+  }
   function closePartner(args, caller) {
     try {
-      var resolved = groupAndPartner(caller);
-      var partner = resolved.partner;
-      var interrupted = !!(partner.isProcessing || partner._queryStarting);
-      if (interrupted) {
-        taskControl.markInterruption(partner, "driver", "The Driver closed the Split Worker pair.");
-        partner.taskStopRequested = true;
-        if (partner.abortController) partner.abortController.abort();
-      }
-      if (partner._pairDelegation) {
-        completeInterruptedTask(partner, caller, partner._pairDelegation);
-        finishDelegation(resolved.group, caller, partner, partner._pairDelegation);
-      }
-      workerPermission.cancelForSession(partner, "The Driver closed the Split Worker pair.");
-      var ws = { _clayUser: caller.ownerId ? { id: caller.ownerId } : null };
-      var result = store.dissolve(ws, { id: resolved.group.id });
-      if (!result.ok) throw new Error(result.error || "could not close the Worker pair");
-      return toolResult({ status: "closed", partnerId: partner.localId, interrupted: interrupted, historyPreserved: true });
+      return toolResult(closeWorker(args, caller));
     } catch (e) {
       return toolError(e);
     }
   }
   function handleHumanStop(session) {
     var roles = turnControl.markHumanStop(session);
-    if (!roles) return false;
-    if (roles.worker._pairDelegation && roles.worker._pairDelegation.outboxKey && ctx.resultOutbox) ctx.resultOutbox.markBlocked(roles.worker._pairDelegation.outboxKey, "The human stopped this Split Worker turn.", "human_stop");
-    taskControl.markInterruption(roles.worker, "user", "The human stopped this Split Worker turn.");
-    workerPermission.cancelForSession(roles.worker, "The human stopped this Split Worker turn.");
-    return true;
+    return stopAllWorkers(session, roles, { resultOutbox: ctx.resultOutbox, taskControl: taskControl, workerPermission: workerPermission });
   }
   function stopOwnedPair(session, reason) { return stopOwned(session, rolesFor(session), turnControl, taskControl, workerPermission, reason); }
   function stopAutonomousWork(session) { return stopAutonomous(session, rolesFor(session), turnControl, taskControl, workerPermission); }
   function beginHumanTurn(session) {
     var resumed = turnControl.beginHumanTurn(session);
     var roles = resumed && rolesFor(session);
-    if (roles) taskControl.drain(roles.driver, roles.worker);
+    if (roles) for (var i = 0; i < roles.workers.length; i++) taskControl.drain(roles.driver, roles.workers[i]);
     return resumed;
   }
   function stopBarrier(session) { return turnControl.blockedReason(session); }
@@ -362,7 +346,8 @@ function attachSessionPair(ctx) {
       evaluate: function () { return toolError(new Error("record_partner_evaluation requires a session-bound tool server")); },
     });
     var group = store.groupForMember(boundSession.localId);
-    if (group && group.pair && group.pair.driverId !== boundSession.localId) return taskControl.workerToolDefs(boundSession);
+    var boundRoles = group && group.pair ? splitRoles.resolveLiveRoles(sm, group) : null;
+    if (boundRoles && boundRoles.workers.indexOf(boundSession) !== -1) return taskControl.workerToolDefs(boundSession);
     var adHocSplit = !!(group && !group.pair);
     if (!driverEligibility.isEligibleDriverSession(boundSession, sm)) return [];
     var persistentCatalog = boundSession.vendor === "codex" && (!group || !!group.pair);
@@ -375,7 +360,7 @@ function attachSessionPair(ctx) {
       send: function (args) {
         return turnControl.runOperation(boundSession, "send", args && args.operationId, function () {
           return sendToPartner(args || {}, boundSession);
-        }, operationFingerprint(args, ["message", "wait", "timeoutSeconds", "taskId"])).catch(toolError);
+        }, operationFingerprint(args, ["message", "wait", "timeoutSeconds", "taskId", "workerId"])).catch(toolError);
       },
       read: function (args) { return readPartner(args, boundSession); },
       message: function (args) {
@@ -391,7 +376,7 @@ function attachSessionPair(ctx) {
       replace: function (args) {
         return turnControl.runOperation(boundSession, "replace", args && args.operationId, function () {
           return workerProposal.proposeReplacement(args || {}, boundSession);
-        }, operationFingerprint(args, ["interrupt", "message", "workerVendor", "workerModel", "workerEffort", "recommendationRationale", "evaluation", "supersedeProposalId"])).catch(toolError);
+        }, operationFingerprint(args, ["interrupt", "message", "workerVendor", "workerModel", "workerEffort", "recommendationRationale", "evaluation", "supersedeProposalId", "workerId"])).catch(toolError);
       },
       evaluate: lifecycleHandlers.evaluate,
     }, { lifecycle: persistentCatalog || !adHocSplit });
@@ -412,12 +397,14 @@ function attachSessionPair(ctx) {
   }
   var factory = attachPairFactory(ctx), createPairRecord = factory.createPairRecord,
     createWorkerForDriver = factory.createWorkerForDriver, createPair = factory.createPair,
+    addWorkerForDriver = factory.addWorkerForDriver, replaceWorkerForDriver = factory.replaceWorkerForDriver,
     preflightWorkerForDriver = factory.preflightWorkerForDriver, createOwnedPair = factory.createOwnedPair, removeOwnedPair = factory.removeOwnedPair,
     preflightRuntime = factory.preflightRuntime;
   lifecycle = attachPairLifecycle({
     sm: sm,
     splitStore: store,
     createWorkerForDriver: function (driver, args) { return createWorkerForDriver(driver, args); },
+    replaceWorkerForDriver: function (driver, worker, args) { return replaceWorkerForDriver(driver, worker, args); },
     preflightWorkerForDriver: function (driver, args) { return preflightWorkerForDriver(driver, args); },
     sendToPartner: function (args, caller) { return sendToPartner(args, caller); },
     finishDelegation: finishDelegation,
@@ -427,6 +414,7 @@ function attachSessionPair(ctx) {
     taskStatus: function (worker) { return taskControl.status(worker); },
     proposalStatus: function (driver) { return workerProposal ? workerProposal.proposalStatus(driver) : null; },
     turnControl: turnControl,
+    multiWorkerFeature: ctx.multiWorkerFeature,
   });
   workerPermission = attachWorkerPermission({
     sm: sm,
@@ -450,7 +438,9 @@ function attachSessionPair(ctx) {
     recordGenerationStart: function (driver, worker) { return lifecycle.recordGenerationStart(driver, worker); },
     sendToPartner: sendToPartner,
     replacePartner: function (args, session) { return lifecycle.replacePartner(args, session); },
+    addWorkerForDriver: function (driver, args) { return addWorkerForDriver(driver, args); },
     preflightWorkerForDriver: preflightWorkerForDriver,
+    multiWorkerFeature: ctx.multiWorkerFeature,
   });
   function handleMessage(ws, msg) {
     if (workerProposal.handleMessage(ws, msg)) return true;
@@ -471,28 +461,15 @@ function attachSessionPair(ctx) {
     }
     return false;
   }
-  function getSystemPrompt(session) {
-    var roles = rolesFor(session);
-    if (roles && roles.worker === session) {
-      var taskId = session._pairDelegation && session._pairDelegation.taskId || "unknown";
-      return pairPrompts.worker(taskId);
-    }
-    var group = store.groupForMember(session.localId);
-    var pairPrompt = "";
-    if (group && group.pair && group.pair.driverId === session.localId) {
-      pairPrompt = pairPrompts.DRIVER_CORE;
-      if (driverOrchestration.isHighTierDriverSession(session, sm)) {
-        pairPrompt += " " + pairPrompts.DRIVER_DELEGATION;
-      }
-    } else if (!group && !ctx.isMate && driverEligibility.isEligibleDriverSession(session, sm) &&
-      driverOrchestration.isHighTierDriverSession(session, sm)) {
-      pairPrompt = pairPrompts.UNPAIRED + " " + workerProposal.getSystemPrompt(session);
-    }
-    return pairPrompt;
-  }
+  var pairPrompt = attachSessionPairPrompt({ sm: sm, store: store, isMate: ctx.isMate, rolesFor: rolesFor,
+    workerProposal: function () { return workerProposal; } });
   var resultPipeline = attachPairResultPipeline({ sm: sm, store: store, resultOutbox: ctx.resultOutbox, getSdk: ctx.getSdk, getLinuxUserForSession: ctx.getLinuxUserForSession, acceptanceTimeoutMs: ctx.acceptanceTimeoutMs, finishDelegation: finishDelegation, resumeDriverWithResult: resumeDriverWithResult, onPartnerResult: ctx.onPartnerResult, onStateChange: ctx.onResultStateChange, blockedReason: turnControl.blockedReason, drain: function (caller, partner) { return taskControl.drain(caller, partner); } });
   resultCapture = resultPipeline.capture; var resultDelivery = resultPipeline.delivery;
-  return { beginHumanTurn: beginHumanTurn, getToolDefs: getToolDefs, handleHumanStop: handleHumanStop, stopOwnedPair: stopOwnedPair, stopAutonomousWork: stopAutonomousWork, stopBarrier: stopBarrier, handleMessage: handleMessage, handleTurnDone: handleTurnDone, getSystemPrompt: getSystemPrompt,
-    respondToWorkerProposal: workerProposal.respondToProposal, workerPermission: workerPermission, createOwnedPair: createOwnedPair, removeOwnedPair: removeOwnedPair, preflightRuntime: preflightRuntime,
-    sendToPartner: sendToPartner, rolesFor: rolesFor, resultCapture: resultCapture, resultOutbox: ctx.resultOutbox, wakePartnerResult: function (caller, partner, token) { return resultDelivery.wake(caller, partner, token); }, getResultOutboxStatus: function () { return ctx.resultOutbox ? ctx.resultOutbox.status() : { records: [], persistenceError: null }; } };
+  closeTransaction = attachPairCloseTransaction({ store: store, multiWorkerFeature: ctx.multiWorkerFeature,
+    resolvePair: function (caller, args) { return groupAndPartner(caller, null, args, { mutation: true, structural: true }); },
+    taskControl: taskControl, resultCapture: resultCapture, workerPermission: workerPermission,
+    responseText: responseText, errorSince: errorSince });
+  return { beginHumanTurn: beginHumanTurn, getToolDefs: getToolDefs, handleHumanStop: handleHumanStop, stopOwnedPair: stopOwnedPair, stopAutonomousWork: stopAutonomousWork, stopBarrier: stopBarrier, handleMessage: handleMessage, handleTurnDone: handleTurnDone, getSystemPrompt: pairPrompt.getSystemPrompt,
+    respondToWorkerProposal: workerProposal.respondToProposal, workerPermission: workerPermission, addWorkerForDriver: addWorkerForDriver, createOwnedPair: createOwnedPair, removeOwnedPair: removeOwnedPair, preflightRuntime: preflightRuntime,
+    sendToPartner: sendToPartner, closeWorker: closeWorker, rolesFor: rolesFor, resultCapture: resultCapture, resultOutbox: ctx.resultOutbox, wakePartnerResult: function (caller, partner, token) { return resultDelivery.wake(caller, partner, token); }, getResultOutboxStatus: function () { return ctx.resultOutbox ? ctx.resultOutbox.status() : { records: [], persistenceError: null }; } };
 } module.exports = { attachSessionPair: attachSessionPair, responseText: responseText, recentTurns: recentTurns };

package/lib/project-worker-creation-proposal.js

@@ -0,0 +1,176 @@
+var crypto = require("crypto");
+var driverEligibility = require("./session-driver-eligibility");
+var multiWorkerFeature = require("./multi-worker-feature");
+var proposalControl = require("./worker-proposal-control");
+var splitRoles = require("./session-split-group-roles");
+
+function generationOf(session) {
+  return session && (session._pairGeneration ||
+    session.sessionProvenance && session.sessionProvenance.generation) || null;
+}
+
+function captureMembership(sm, driver, group) {
+  var roles = splitRoles.resolveLiveRoles(sm, group);
+  if (!roles || roles.driver !== driver || roles.role.kind === "adhoc" || !driver.sessionOriginId) return null;
+  var workers = [];
+  for (var i = 0; i < roles.workers.length; i++) {
+    if (!roles.workers[i].sessionOriginId || !Number.isInteger(generationOf(roles.workers[i]))) return null;
+    workers.push({ id: roles.workers[i].localId, originId: roles.workers[i].sessionOriginId,
+      generation: generationOf(roles.workers[i]) });
+  }
+  return { groupId: group.id, ownerId: driver.ownerId || null, driverId: driver.localId,
+    driverOriginId: driver.sessionOriginId, workerIds: roles.role.workerIds.slice(), workers: workers };
+}
+
+function matchesMembership(sm, driver, group, snapshot) {
+  if (!snapshot || !driver || !group || group.id !== snapshot.groupId || driver.localId !== snapshot.driverId ||
+      (driver.ownerId || null) !== snapshot.ownerId || driver.sessionOriginId !== snapshot.driverOriginId) return false;
+  var current = captureMembership(sm, driver, group);
+  if (!current || current.workerIds.join(",") !== snapshot.workerIds.join(",")) return false;
+  for (var i = 0; i < current.workers.length; i++) {
+    var expected = snapshot.workers[i];
+    if (!expected || current.workers[i].id !== expected.id || current.workers[i].originId !== expected.originId ||
+        current.workers[i].generation !== expected.generation) return false;
+  }
+  return true;
+}
+
+function attachWorkerCreationProposal(ctx) {
+  var sm = ctx.sm;
+  var store = ctx.splitStore;
+
+  function initialSnapshot(session) {
+    if (!ctx.canOffer(session)) return { error: "Split Worker proposals require an eligible Driver session." };
+    var group = store.groupForMember(session.localId);
+    if (!group) return { kind: "initial", driver: session };
+    if (!multiWorkerFeature.isEnabled(ctx.multiWorkerFeature)) {
+      return { error: "This Driver already has a Split Worker." };
+    }
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.driver !== session || roles.role.kind === "adhoc") {
+      return { error: "The exact Driver/Split Worker membership is not eligible for another Worker." };
+    }
+    if (roles.workers.length >= 2) return { error: "A Driver can have at most two Split Workers." };
+    if (roles.workers.length !== 1) return { error: "The existing Split Worker membership is invalid." };
+    if (!session.sessionOriginId || !roles.workers[0].sessionOriginId || !Number.isInteger(generationOf(roles.workers[0]))) {
+      return { error: "The exact Driver and Split Worker identities are not durable enough to add another Worker." };
+    }
+    return {
+      kind: "add",
+      group: group,
+      groupId: group.id,
+      ownerId: session.ownerId || null,
+      driverId: session.localId,
+      driverOriginId: session.sessionOriginId || null,
+      workerIds: roles.role.workerIds.slice(),
+      workers: roles.workers.map(function (worker) {
+        return { id: worker.localId, originId: worker.sessionOriginId || null, generation: generationOf(worker) };
+      }),
+    };
+  }
+
+  function validateSnapshot(session, snapshot, requireSameObject) {
+    if (!snapshot || snapshot.kind === "initial") {
+      return ctx.isEligible(session) ? { ok: true, group: null } : { ok: false };
+    }
+    if (!multiWorkerFeature.isEnabled(ctx.multiWorkerFeature) || !ctx.canOffer(session) ||
+        (session.ownerId || null) !== snapshot.ownerId || session.localId !== snapshot.driverId ||
+        (session.sessionOriginId || null) !== snapshot.driverOriginId) return { ok: false };
+    var group = store.groupForMember(session.localId);
+    if (!group || group.id !== snapshot.groupId || requireSameObject && group !== snapshot.group) return { ok: false };
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.role.kind === "adhoc" || roles.driver !== session || roles.role.workerIds.length !== 1 ||
+        roles.role.workerIds.join(",") !== snapshot.workerIds.join(",")) return { ok: false };
+    for (var i = 0; i < snapshot.workers.length; i++) {
+      var expected = snapshot.workers[i];
+      var worker = sm.sessions.get(expected.id);
+      if (!worker || roles.workers.indexOf(worker) === -1 ||
+          (worker.ownerId || null) !== snapshot.ownerId ||
+          (worker.sessionOriginId || null) !== expected.originId || generationOf(worker) !== expected.generation) {
+        return { ok: false };
+      }
+    }
+    return { ok: true, group: group, roles: roles };
+  }
+
+  function snapshotFromProposal(proposal) {
+    if (!proposal || proposal.action !== "add") return { kind: "initial" };
+    return {
+      kind: "add",
+      groupId: proposal.sourceGroupId,
+      ownerId: proposal.sourceOwnerId || null,
+      driverId: proposal.sourceDriverId,
+      driverOriginId: proposal.sourceDriverOriginId || null,
+      workerIds: Array.isArray(proposal.sourceWorkerIds) ? proposal.sourceWorkerIds.slice() : [],
+      workers: Array.isArray(proposal.sourceWorkers) ? proposal.sourceWorkers.slice() : [],
+    };
+  }
+
+  async function propose(args, session) {
+    var snapshot = initialSnapshot(session);
+    if (snapshot.error) return ctx.toolResult({ error: snapshot.error });
+    var superseded = proposalControl.pendingProposal(session);
+    var supersedeId = typeof args.supersedeProposalId === "string" ? args.supersedeProposalId.trim() : "";
+    if (superseded && superseded.proposalId !== supersedeId) return ctx.toolResult({ error: "A Split Worker suggestion is already awaiting a decision. Inspect it or supply its exact id to supersede it." });
+    if (!superseded && supersedeId) return ctx.toolResult({ error: "The Split Worker suggestion to supersede is no longer pending." });
+    if (superseded && superseded.status !== "pending") return ctx.toolResult({ error: "The Split Worker suggestion is already starting and cannot be superseded." });
+    var summary = typeof args.summary === "string" ? args.summary.trim() : "";
+    var plan = typeof args.plan === "string" ? args.plan.trim() : "";
+    var task = typeof args.message === "string" ? args.message.trim() : "";
+    var rationale = typeof args.recommendationRationale === "string" ? args.recommendationRationale.trim() : "";
+    if (!summary || !plan || !task || !rationale) return ctx.toolResult({ error: "summary, plan, message, and recommendationRationale are required." });
+    if (task.length > ctx.maxTaskChars) return ctx.toolResult({ error: "The Split Worker task is too long." });
+    await ctx.ensureModelCatalogs();
+    if (!validateSnapshot(session, snapshot, true).ok) {
+      return ctx.toolResult({ error: "The Driver/Split Worker membership changed while runtimes were loading." });
+    }
+    if (proposalControl.pendingProposal(session) !== superseded) return ctx.toolResult({ error: "The pending Split Worker suggestion changed while runtimes were loading." });
+    var options = ctx.proposalOptions();
+    if (options.installedVendors.length === 0) return ctx.toolResult({ error: "No coding agent is installed for a Split Worker session." });
+    var recommendation = ctx.chooseRecommendation(args, session, options);
+    var proposal = {
+      type: "worker_proposal", proposalId: "worker_" + crypto.randomUUID(),
+      summary: summary.slice(0, ctx.maxSummaryChars), plan: plan.slice(0, ctx.maxPlanChars), message: task,
+      status: "pending", createdAt: Date.now(), recommendedVendor: recommendation.vendor,
+      recommendedModel: recommendation.model, recommendedEffort: recommendation.effort,
+      recommendationRationale: rationale.slice(0, ctx.maxRationaleChars), options: options,
+    };
+    if (snapshot.kind === "add") Object.assign(proposal, {
+      action: "add", sourceGroupId: snapshot.groupId, sourceOwnerId: snapshot.ownerId,
+      sourceDriverId: snapshot.driverId, sourceDriverOriginId: snapshot.driverOriginId,
+      sourceWorkerIds: snapshot.workerIds.slice(), sourceWorkers: snapshot.workers.slice(),
+    });
+    if (superseded) ctx.updateProposal(session, superseded, { status: "superseded", supersededBy: proposal.proposalId });
+    sm.sendAndRecord(session, proposal);
+    if (ctx.skipPermissionsEnabled(session) && ctx.recommendationCanAutoAccept(args, recommendation, options)) {
+      var accepted = await ctx.acceptProposal(session, proposal, {
+        vendor: recommendation.vendor, model: recommendation.model, effort: recommendation.effort,
+      }, ctx.autoAcceptanceWs(session), true);
+      return ctx.toolResult({ status: accepted.ok ? "auto_accepted" : "posted", proposalId: proposal.proposalId,
+        instruction: accepted.ok ? "The recorded Split Worker configuration was auto-accepted. End this turn while the exact Worker runs." :
+          "The automatic decision failed closed. The configuration card remains pending for the user." });
+    }
+    return ctx.toolResult({ status: "posted", proposalId: proposal.proposalId,
+      instruction: "The Split Worker suggestion is visible in the chat. End this turn now and wait for the user's decision." });
+  }
+
+  function canMountProposal(session) {
+    if (!ctx.canOffer(session)) return false;
+    var group = store.groupForMember(session.localId);
+    if (!group) return true;
+    if (!multiWorkerFeature.isEnabled(ctx.multiWorkerFeature)) return false;
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    return !!roles && roles.role.kind !== "adhoc" && roles.driver === session;
+  }
+
+  return {
+    propose: propose,
+    canMountProposal: canMountProposal,
+    validateAcceptance: function (session, proposal) {
+      return validateSnapshot(session, snapshotFromProposal(proposal), false);
+    },
+  };
+}
+
+module.exports = { attachWorkerCreationProposal: attachWorkerCreationProposal,
+  captureMembership: captureMembership, matchesMembership: matchesMembership };

package/lib/project-worker-permission.js

@@ -43,6 +43,7 @@
 // same user. Anything else is refused and the request stays pending.
 
 var crypto = require("crypto");
+var splitRoles = require("./session-split-group-roles");
 
 // Tools that collect input from the person rather than authorize an action.
 // These are not permission approvals, so they are never routed to a Driver;
@@ -104,20 +105,18 @@ function attachWorkerPermission(ctx) {
     if (sm.sessions.get(session.localId) !== session) return null;
     var group = store.groupForMember(session.localId);
     if (!group || !group.pair) return null;
-    if (group.pair.workerId !== session.localId) return null;
-    var driver = sm.sessions.get(group.pair.driverId);
-    if (!driver) return null;
-    if ((driver.ownerId || null) !== (session.ownerId || null)) return null;
-    if (driver.destroying) return null;
-    return { group: group, driver: driver };
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.workers.indexOf(session) === -1) return null;
+    return { group: group, driver: roles.driver };
   }
 
   // Is the record's pair still exactly the pair it was created for?
   function pairStillExact(record) {
     var group = store ? store.groupForMember(record.workerId) : null;
     if (!group || group.id !== record.groupId || !group.pair) return false;
-    if (group.pair.driverId !== record.driverId) return false;
-    if (group.pair.workerId !== record.workerId) return false;
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.driver.localId !== record.driverId) return false;
+    if (roles.workers.indexOf(record.workerRef) === -1 || record.workerRef.localId !== record.workerId) return false;
     var driver = sm.sessions.get(record.driverId);
     var worker = sm.sessions.get(record.workerId);
     if (!driver || !worker || driver.destroying || worker.destroying) return false;

package/lib/project-worker-proposal-runner.js

@@ -0,0 +1,45 @@
+function attachProposalRunner(ctx) {
+  function resumeDriver(session, text) {
+    var sdk = ctx.getSdk();
+    if (!sdk) return Promise.reject(new Error("SDK bridge is not ready"));
+    ctx.sm.sendAndRecord(session, { type: "user_message", text: text, _internal: true });
+    session.sentToolResults = {};
+    if (!session.isProcessing) {
+      session.isProcessing = true;
+      ctx.onProcessingChanged();
+      ctx.sm.sendToSession(session, { type: "status", status: "processing" });
+    }
+    if (sdk.pushMessage(session, text)) return Promise.resolve();
+    return Promise.resolve(sdk.startQuery(session, text, undefined, ctx.getLinuxUserForSession(session)));
+  }
+
+  function parseResult(result) {
+    if (!result || result.isError || !result.content || !result.content[0]) {
+      return { status: "error", error: "Split Worker execution failed." };
+    }
+    try { return JSON.parse(result.content[0].text); }
+    catch (error) { return { status: "error", error: result.content[0].text || "Split Worker execution failed." }; }
+  }
+
+  async function runWorker(session, proposal) {
+    var result = parseResult(await ctx.sendToPartner({ message: proposal.message, wait: true,
+      timeoutSeconds: 900, workerId: proposal.workerId }, session));
+    ctx.updateProposal(session, proposal, { status: result.status === "complete" ? "completed" : result.status || "error",
+      resultPreview: result.response ? result.response.slice(0, 1200) : "", error: result.error || null });
+    var followup;
+    if (result.status === "complete") {
+      followup = "[Split Worker execution completed]\nReview and verify the Split Worker's result. The Split Worker session remains available: if the implementation needs corrections or additional edits, send a follow-up with send_to_partner instead of taking over the Split Worker-owned files yourself. If that Split Worker is no longer available, keep the work in the visible Split Worker flow and use send_to_partner again after the stale pair is removed; never substitute a background Sub-agent.\n\n" + (result.response || "The Split Worker completed without a text summary.");
+    } else if (result.status === "interrupted") {
+      followup = "[Split Worker execution interrupted]\nThe Split Worker stopped mid-turn. Its work is PARTIAL and unverified — do not treat it as finished. Check partner_status before deciding next steps; this result alone does not identify who interrupted it. If the human stopped it, do not retry until a new human Driver message. Otherwise continue within the user's authorized task.";
+    } else if (result.status === "running") {
+      followup = "[Split Worker execution is still running]\nUse read_partner to inspect progress before completing the task.";
+    } else {
+      followup = "[Split Worker execution failed]\nThe existing Split Worker may still be reusable. Inspect partner_status and send a narrower follow-up with send_to_partner when the Worker and pair still exist; do not replace it merely because its task or transport failed. Retry replacement only when the replacement transaction reports that no new Worker was created and the failure is explicitly safe to retry.\n\n" + (result.error || result.response || "Unknown Split Worker error.");
+    }
+    await resumeDriver(session, followup);
+  }
+
+  return { resumeDriver: resumeDriver, runWorker: runWorker };
+}
+
+module.exports = { attachProposalRunner: attachProposalRunner };