clay-server 4.3.1-beta.1 → 4.3.1-beta.3

package/lib/project-connection.js

@@ -244,7 +244,7 @@ function attachConnection(ctx) {
     // so vendor badges showed Claude until the next broadcast).
     sendTo(ws, {
       type: "session_list",
-      sessions: sm.mapSessionsForClient(allSessions),
+      sessions: sm.mapSessionsForClient(allSessions, undefined, undefined, wsUser ? wsUser.id : null),
     });
     if (_splitGroups) _splitGroups.sendConnectionState(ws);
 

package/lib/project-pair-lifecycle.js

@@ -162,6 +162,15 @@ function attachPairLifecycle(ctx) {
     return null;
   }
   function partnerStatus(caller, args) {
+    var group = caller && store.groupForMember(caller.localId);
+    var roles = splitRoles.normalizePair(group && group.pair, group && group.members);
+    if ((!args || args.workerId == null) && roles.ok && roles.kind !== "adhoc" && roles.workerIds.length > 1) {
+      var workers = roles.workerIds.map(function (workerId) {
+        return partnerStatus(caller, { workerId: workerId });
+      });
+      return { driverId: caller.localId, workerIds: roles.workerIds.slice(), workers: workers,
+        instruction: "Pass the selected workerId to targeted partner tools. Call partner_status without workerId to rediscover current Workers." };
+    }
     var resolved = resolveDriverPair(caller, args, { readOnly: true });
     var worker = resolved.worker;
     var blocked = turnControl.blockedReason(caller) || replaceBlockedReason(worker);

package/lib/project-session-delete.js

@@ -0,0 +1,101 @@
+var sessionProvenance = require("./session-provenance");
+
+// Explicit human deletion of a Driver also removes every Split Worker
+// generation it durably owns. Ownership comes only from the provenance
+// hierarchy: a unique parent origin, the same owner, and a parent that is not
+// itself a Worker. Ambiguous or cross-owner links are never expanded. Close,
+// dissolve, and replacement do not come through here and keep history, and
+// deleting a Worker never removes its Driver or siblings.
+
+function resolveDeletionScope(sessions, requested, canDelete) {
+  var workersByDriver = sessionProvenance.ownedWorkersByDriver(Array.from(sessions.values()));
+  var ids = [];
+  var cascadedIds = [];
+  var seen = {};
+  function add(session, cascaded) {
+    if (seen[session.localId]) return;
+    seen[session.localId] = true;
+    ids.push(session.localId);
+    if (cascaded) cascadedIds.push(session.localId);
+  }
+  for (var j = 0; j < requested.length; j++) {
+    var target = requested[j];
+    add(target, false);
+    if (sessionProvenance.isWorker(target)) continue;
+    var owned = workersByDriver[target.localId] || [];
+    for (var k = 0; k < owned.length; k++) {
+      // The whole scope is authorized before anything is removed.
+      if (!canDelete(owned[k])) {
+        return { ok: false, error: "You cannot delete this Driver because one of its Split Worker sessions is not accessible to you" };
+      }
+      add(owned[k], true);
+    }
+  }
+  return { ok: true, ids: ids, cascadedIds: cascadedIds };
+}
+
+function attachSessionDelete(ctx) {
+  var sm = ctx.sm;
+  var usersModule = ctx.usersModule;
+  var getProjectAccess = ctx.getProjectAccess || function () { return { visibility: "public" }; };
+
+  function hasDeletePermission(ws) {
+    if (!ws._clayUser) return true;
+    return !!usersModule.getEffectivePermissions(ws._clayUser, ctx.osUsers).sessionDelete;
+  }
+  function accessCheck(ws, access) {
+    return function (session) {
+      if (!usersModule.isMultiUser()) return true;
+      return !!(ws._clayUser && usersModule.canAccessSession(ws._clayUser.id, session, access));
+    };
+  }
+  function releaseRuntime(ids) {
+    for (var i = 0; i < ids.length; i++) {
+      var session = sm.sessions.get(ids[i]);
+      if (!session) continue;
+      // TUI sessions: reap the PTY and stop title watchers before the
+      // records are wiped so no `claude` process is left orphaned.
+      if (ctx.tm && session.mode === "tui" && typeof session.terminalId === "number") {
+        try { ctx.tm.close(session.terminalId); } catch (e) {}
+      }
+      ctx.stopTitleWatcher(session);
+    }
+  }
+  function refuse(ws, text) {
+    ctx.sendTo(ws, { type: "error", text: text });
+  }
+
+  function deleteSession(ws, msg) {
+    if (!hasDeletePermission(ws)) return refuse(ws, "You do not have permission to delete sessions");
+    if (!msg.id || !sm.sessions.has(msg.id)) return;
+    var target = sm.sessions.get(msg.id);
+    var canDelete = accessCheck(ws, getProjectAccess());
+    if (!canDelete(target)) return;
+    var scope = resolveDeletionScope(sm.sessions, [target], canDelete);
+    if (!scope.ok) return refuse(ws, scope.error);
+    releaseRuntime(scope.ids);
+    if (scope.ids.length === 1) sm.deleteSession(target.localId, ws);
+    else sm.deleteSessionsBulk(scope.ids, ws);
+  }
+
+  function bulkDeleteSessions(ws, msg) {
+    if (!Array.isArray(msg.sessionIds) || msg.sessionIds.length === 0) return;
+    if (!hasDeletePermission(ws)) return refuse(ws, "You do not have permission to delete sessions");
+    var canDelete = accessCheck(ws, { visibility: "public" });
+    var requested = [];
+    for (var i = 0; i < msg.sessionIds.length; i++) {
+      var id = msg.sessionIds[i];
+      var target = typeof id === "number" ? sm.sessions.get(id) : null;
+      if (target && canDelete(target)) requested.push(target);
+    }
+    if (requested.length === 0) return;
+    var scope = resolveDeletionScope(sm.sessions, requested, canDelete);
+    if (!scope.ok) return refuse(ws, scope.error);
+    releaseRuntime(scope.ids);
+    sm.deleteSessionsBulk(scope.ids, ws);
+  }
+
+  return { deleteSession: deleteSession, bulkDeleteSessions: bulkDeleteSessions };
+}
+
+module.exports = { attachSessionDelete: attachSessionDelete, resolveDeletionScope: resolveDeletionScope };

package/lib/project-session-pair-prompt.js

@@ -13,6 +13,11 @@ function attachSessionPairPrompt(ctx) {
     var result = "";
     if (group && group.pair && group.pair.driverId === session.localId) {
       result = prompts.DRIVER_CORE + " " + ctx.workerProposal().getSystemPrompt(session);
+      if (roles && roles.driver === session) {
+        result += " Current configured Worker handles: " + roles.workers.map(function (worker) {
+          return "workerId=" + worker.localId + " (" + (worker.title || "Worker") + ")";
+        }).join(", ") + ". Call partner_status without workerId to rediscover current Workers; pass workerId for targeted operations.";
+      }
       if (driverOrchestration.isHighTierDriverSession(session, ctx.sm)) result += " " + prompts.DRIVER_DELEGATION;
     } else if (!group && !ctx.isMate && driverEligibility.isEligibleDriverSession(session, ctx.sm) &&
         driverOrchestration.isHighTierDriverSession(session, ctx.sm)) {

package/lib/project-sessions.js

@@ -7,6 +7,7 @@ var updateSnooze = require("./update-snooze");
 var yoke = require("./yoke");
 var sessionVisibility = require("./session-visibility");
 var contextUsageModule = require("./context-usage");
+var sessionDeleteModule = require("./project-session-delete");
 
 function vendorSupportsTui(vendor) {
   var info = yoke.getVendorInfo(vendor);
@@ -337,6 +338,11 @@ function attachSessions(ctx) {
     }
   }
 
+  var sessionDelete = sessionDeleteModule.attachSessionDelete({
+    sm: sm, usersModule: usersModule, osUsers: osUsers, tm: tm, sendTo: sendTo,
+    getProjectAccess: getProjectAccess, stopTitleWatcher: stopTitleWatcher,
+  });
+
   // Kick off watchers for any TUI sessions already loaded from disk so
   // their titles refresh as soon as Claude Code rewrites the jsonl, even
   // before the user clicks them.
@@ -779,31 +785,7 @@ function attachSessions(ctx) {
     }
 
     if (msg.type === "bulk_delete_sessions") {
-      if (!Array.isArray(msg.sessionIds) || msg.sessionIds.length === 0) return true;
-      var deletableIds = [];
-      for (var di = 0; di < msg.sessionIds.length; di++) {
-        var bulkId = msg.sessionIds[di];
-        if (typeof bulkId !== "number") continue;
-        var bulkTarget = sm.sessions.get(bulkId);
-        if (!bulkTarget) continue;
-        if (usersModule.isMultiUser() && ws._clayUser) {
-          if (!usersModule.canAccessSession(ws._clayUser.id, bulkTarget, { visibility: "public" })) continue;
-        }
-        deletableIds.push(bulkId);
-      }
-      if (deletableIds.length > 0) {
-        // TUI sessions: kill their PTYs and stop title watchers before the
-        // records are wiped.
-        for (var bdi = 0; bdi < deletableIds.length; bdi++) {
-          var bdTarget = sm.sessions.get(deletableIds[bdi]);
-          if (!bdTarget) continue;
-          if (tm && bdTarget.mode === "tui" && typeof bdTarget.terminalId === "number") {
-            try { tm.close(bdTarget.terminalId); } catch (e) {}
-          }
-          stopTitleWatcher(bdTarget);
-        }
-        sm.deleteSessionsBulk(deletableIds, ws);
-      }
+      sessionDelete.bulkDeleteSessions(ws, msg);
       return true;
     }
 
@@ -978,25 +960,7 @@ function attachSessions(ctx) {
     }
 
     if (msg.type === "delete_session") {
-      if (ws._clayUser) {
-        var sdPerms = usersModule.getEffectivePermissions(ws._clayUser, osUsers);
-        if (!sdPerms.sessionDelete) {
-          sendTo(ws, { type: "error", text: "You do not have permission to delete sessions" });
-          return true;
-        }
-      }
-      if (msg.id && sm.sessions.has(msg.id)) {
-        // TUI session: kill the underlying PTY before deleting the session
-        // record so the `claude` process is reaped and not left orphaned.
-        var dsTarget = sm.sessions.get(msg.id);
-        if (usersModule.isMultiUser() && (!ws._clayUser ||
-            !usersModule.canAccessSession(ws._clayUser.id, dsTarget, getProjectAccess()))) return true;
-        if (dsTarget && dsTarget.mode === "tui" && typeof dsTarget.terminalId === "number" && tm) {
-          try { tm.close(dsTarget.terminalId); } catch (e) {}
-        }
-        if (dsTarget) stopTitleWatcher(dsTarget);
-        sm.deleteSession(msg.id, ws);
-      }
+      sessionDelete.deleteSession(ws, msg);
       return true;
     }
 

package/lib/project-worker-proposal-runner.js

@@ -36,6 +36,8 @@ function attachProposalRunner(ctx) {
     } else {
       followup = "[Split Worker execution failed]\nThe existing Split Worker may still be reusable. Inspect partner_status and send a narrower follow-up with send_to_partner when the Worker and pair still exist; do not replace it merely because its task or transport failed. Retry replacement only when the replacement transaction reports that no new Worker was created and the failure is explicitly safe to retry.\n\n" + (result.error || result.response || "Unknown Split Worker error.");
     }
+    followup += "\n\nWorker handle for this execution: workerId=" + proposal.workerId +
+      ". Use this workerId for follow-up operations while it remains configured. Call partner_status without workerId to discover current Worker handles after replacement or reconnect.";
     await resumeDriver(session, followup);
   }
 

package/lib/project-worker-proposal.js

@@ -463,7 +463,7 @@ function attachWorkerProposal(ctx) {
 
   function getSystemPrompt(session) {
     if (creationProposal.canMountProposal(session) && !isEligible(session)) {
-      return "This Driver may configure one additional Split Worker through propose_worker. With two Workers, pass workerId to every targeted partner, queue, interrupt, replacement, close, permission, and status operation. Give each Worker independent file ownership and bounded work. Do not assign simultaneous overlapping file edits unless the work is explicitly separated, such as by distinct paths or worktrees.";
+      return "This Driver may configure one additional Split Worker through propose_worker. With two Workers, pass workerId to every targeted partner, queue, interrupt, replacement, close, permission, and targeted status operation. Call partner_status without workerId to discover current Worker handles. Give each Worker independent file ownership and bounded work. Do not assign simultaneous overlapping file edits unless the work is explicitly separated, such as by distinct paths or worktrees.";
     }
     if (!isEligible(session) || !driverOrchestration.isHighTierDriverSession(session, sm)) return "";
     return "For implementation-heavy work, use propose_worker before substantial execution. Work is implementation-heavy when it spans multiple modules, crosses client/server/data boundaries, requires a migration, or contains independent investigation and execution. Do not skip delegation merely because you can implement it yourself; preserve the Driver for decomposition, runtime selection, judgment, review, and integration. The user's explicit request to work directly takes precedence, and work that must remain sequential in this session stays here. Recommend an exact available vendor, model, and effort, and give a concise recommendationRationale explaining why all three fit the task. Clay always records and shows the runtime configuration card. In full-access mode Clay may auto-accept that exact validated recommendation; otherwise it waits for the user's explicit choice. After posting, end the turn. If accepted, Clay creates the exact Driver/Split Worker pair and delegates the proposed task once. If declined, continue in this Driver session. Do not call send_to_partner while unpaired.";

package/lib/project.js

@@ -2568,6 +2568,7 @@ function createProjectContext(opts) {
   function destroy() {
     if (_scheduledMessages) _scheduledMessages.shutdown();
     if (_autonomousRun) _autonomousRun.shutdown();
+    _splitGroups.shutdown();
     _loop.stopTimer();
     _email.destroy();
     stopFileWatch();

package/lib/public/css/pane.css

@@ -73,13 +73,11 @@ body.pane-mode #input-area {
   display: flex;
 }
 
-/* A configured two-Worker group is a deliberate workspace hierarchy: the
-   Driver gets the broad working canvas, while both Workers remain visible as
-   equal-height execution surfaces on the right. Legacy/ad-hoc two-pane
-   splits keep the ordinary equal columns below. */
+/* Keep the same equal columns when adding a second Worker; only the
+   Worker column divides into two equal-height execution surfaces. */
 #split-host:has(.split-pane-role-worker:nth-of-type(3)) {
   display: grid;
-  grid-template-columns: minmax(0, 3fr) minmax(260px, 2fr);
+  grid-template-columns: repeat(2, minmax(0, 1fr));
   grid-template-rows: repeat(2, minmax(0, 1fr));
   gap: 1px;
   background: var(--border-subtle);

package/lib/public/modules/session-delete-scope.js

@@ -0,0 +1,96 @@
+// Describes the server deletion scope so confirmations never understate it.
+// Deleting a Driver also deletes every Split Worker session it owns,
+// including hidden sessions and previous generations. The server sends that
+// full total as `ownedWorkerCount`; the visible list alone can miss hidden
+// Workers, so it never stands in for the total. When the total is unknown,
+// the wording says so and a dialog is required. Deleting a Worker affects only
+// that Worker.
+
+var FULL_SCOPE = "including hidden sessions and previous generations";
+
+export function ownedWorkerIds(driverId, sessions) {
+  var list = Array.isArray(sessions) ? sessions : [];
+  var ids = [];
+  for (var i = 0; i < list.length; i++) {
+    var session = list[i];
+    if (session && session.sessionRole === "worker" && session.parentAvailable && session.parentSessionId === driverId) {
+      ids.push(session.id);
+    }
+  }
+  return ids;
+}
+
+function findSession(sessionId, sessions) {
+  var list = Array.isArray(sessions) ? sessions : [];
+  for (var i = 0; i < list.length; i++) if (list[i] && list[i].id === sessionId) return list[i];
+  return null;
+}
+
+// { worker: true } | { known: true, visible, total } | { known: false, visible }
+function ownership(session, sessions) {
+  if (!session) return { known: false, visible: [] };
+  if (session.sessionRole === "worker") return { worker: true, visible: [] };
+  var visible = ownedWorkerIds(session.id, sessions);
+  if (typeof session.ownedWorkerCount !== "number" || session.ownedWorkerCount < 0) return { known: false, visible: visible };
+  return { known: true, visible: visible, total: Math.max(session.ownedWorkerCount, visible.length) };
+}
+
+function workerPhrase(count) {
+  return count + " Split Worker " + (count === 1 ? "session" : "sessions");
+}
+
+export function describeSessionDelete(session, sessions) {
+  var cached = session ? findSession(session.id, sessions) : null;
+  var resolved = cached || (session && session.sessionRole ? session : null);
+  var title = (session && session.title) || (cached && cached.title) || "New Session";
+  var base = 'Delete "' + title + '"? ';
+  var owner = ownership(resolved, sessions);
+  if (owner.worker || (owner.known && owner.total === 0)) {
+    return { workerCount: 0, requiresDialog: false, message: base + "This session and its history will be permanently removed." };
+  }
+  if (owner.known) {
+    return { workerCount: owner.total, requiresDialog: true,
+      message: base + "This Driver and all " + workerPhrase(owner.total) + " it owns, " + FULL_SCOPE +
+        ", will be permanently removed with their history." };
+  }
+  return { workerCount: null, requiresDialog: true,
+    message: base + "This session and its history will be permanently removed. If it is a Driver, every Split Worker session it owns, " +
+      FULL_SCOPE + ", will also be permanently removed." };
+}
+
+export function describeGroupDelete(groupLabel, sessionIds, sessions) {
+  var requested = [];
+  var seen = new Set();
+  var list = Array.isArray(sessionIds) ? sessionIds : [];
+  for (var r = 0; r < list.length; r++) {
+    if (seen.has(list[r])) continue;
+    seen.add(list[r]);
+    requested.push(list[r]);
+  }
+  var ids = requested.slice();
+  var hidden = 0;
+  var unknown = 0;
+  for (var i = 0; i < requested.length; i++) {
+    var owner = ownership(findSession(requested[i], sessions), sessions);
+    if (owner.worker) continue;
+    for (var j = 0; j < owner.visible.length; j++) {
+      if (seen.has(owner.visible[j])) continue;
+      seen.add(owner.visible[j]);
+      ids.push(owner.visible[j]);
+    }
+    if (owner.known) hidden += owner.total - owner.visible.length;
+    else unknown++;
+  }
+  var cascaded = ids.length - requested.length + hidden;
+  var total = ids.length + hidden;
+  var noun = total === 1 ? "session" : "sessions";
+  var message = 'Clear "' + groupLabel + '"? ';
+  if (unknown > 0) {
+    message += "At least " + total + " " + noun + " will be permanently removed, plus every Split Worker session owned by a Driver here, " + FULL_SCOPE + ".";
+  } else {
+    message += total + " " + noun + " will be permanently removed";
+    if (cascaded > 0) message += ", including " + workerPhrase(cascaded) + " owned by these Drivers, " + FULL_SCOPE;
+    message += ".";
+  }
+  return { ids: ids, cascadedCount: cascaded, exact: unknown === 0, message: message };
+}

package/lib/public/modules/sidebar-sessions.js

@@ -18,6 +18,7 @@ import { groupedSessionIds } from './split-group-helpers.js';
 import { defaultVendorUnavailable, resolvePreferredVendor, saveDefaultVendor } from './default-vendor.js';
 import { openPairDialog } from './split-pair-ui.js';
 import { renderSessionCreationCta } from './session-creation-cta.js';
+import { describeSessionDelete, describeGroupDelete } from './session-delete-scope.js';
 import {
   hierarchyItemMatches,
   prepareSidebarHierarchy,
@@ -192,7 +193,7 @@ function spawnSessionDeleteParticles(sessionId) {
 }
 
 function confirmDeleteSession(session) {
-  showConfirm('Delete "' + (session.title || "New Session") + '"? This session and its history will be permanently removed.', function () {
+  showConfirm(describeSessionDelete(session, cachedSessions).message, function () {
     var ws = getWs();
     if (ws && store.get('connected')) {
       ws.send(JSON.stringify({ type: "delete_session", id: session.id }));
@@ -271,9 +272,7 @@ function collectItemSessionIds(item) {
 
 function confirmDeleteSessionGroup(groupLabel, sessionIds) {
   if (!Array.isArray(sessionIds) || sessionIds.length === 0) return;
-  var count = sessionIds.length;
-  var noun = count === 1 ? "session" : "sessions";
-  showConfirm('Clear "' + groupLabel + '"? ' + count + " " + noun + ' will be permanently removed.', function () {
+  showConfirm(describeGroupDelete(groupLabel, sessionIds, cachedSessions).message, function () {
     var ws = getWs();
     if (ws && store.get('connected')) {
       ws.send(JSON.stringify({ type: "bulk_delete_sessions", sessionIds: sessionIds }));
@@ -319,6 +318,13 @@ function appendSessionCloseButton(el, session) {
   closeBtn.addEventListener("click", function (e) {
     e.preventDefault();
     e.stopPropagation();
+    // A deletion that removes or may remove Split Workers always gets the
+    // explicit dialog instead of the two-click armed shortcut.
+    if (describeSessionDelete(session, cachedSessions).requiresDialog) {
+      clearArmedSessionDelete();
+      confirmDeleteSession(session);
+      return;
+    }
     if (armedDeleteSessionId === session.id) {
       clearArmedSessionDelete();
       deleteSessionImmediately(session);

package/lib/session-pair-mcp-server.js

@@ -63,8 +63,8 @@ function getToolDefs(handlers, options) {
     },
     {
       name: "partner_status",
-      description: "Bounded capacity and continuity report for your Split Worker, for deciding reuse against replacement: context tokens used and the ratio of its window, current task and activity, vendor/model/effort, history size and idle time, whether it is safe to replace right now, and your own recorded results for earlier Worker generations. Returns no transcript. Prefer this over reading turns when you only need to decide.",
-      inputSchema: buildShape({ workerId: { type: "number", description: "Optional exact Worker session id; required when multiple Workers are configured." } }),
+      description: "Bounded capacity and continuity report for your Split Worker, for deciding reuse against replacement: context tokens used and the ratio of its window, current task and activity, vendor/model/effort, history size and idle time, whether it is safe to replace right now, and your own recorded results for earlier Worker generations. Returns no transcript. Prefer this over reading turns when you only need to decide. Omit workerId to discover all configured Workers and their current numeric handles; pass workerId for one Worker.",
+      inputSchema: buildShape({ workerId: { type: "number", description: "Optional exact Worker session id. Omit to list all configured Workers and their current handles." } }),
       handler: function (args) { return handlers.status(args || {}); },
     },
     {

package/lib/session-provenance.js

@@ -110,9 +110,25 @@ function hierarchyFor(sessions) {
   return result;
 }
 
+// Every Worker the hierarchy links to each Driver, keyed by Driver local id.
+// This is the exact scope a Driver deletion cascades to, including hidden
+// sessions and replaced generations.
+function ownedWorkersByDriver(sessions) {
+  var hierarchy = hierarchyFor(sessions);
+  var result = {};
+  for (var i = 0; i < sessions.length; i++) {
+    var node = hierarchy[sessions[i].localId];
+    if (!node || node.role !== "worker" || node.parentSessionId == null) continue;
+    if (!result[node.parentSessionId]) result[node.parentSessionId] = [];
+    result[node.parentSessionId].push(sessions[i]);
+  }
+  return result;
+}
+
 module.exports = {
   ensureOrigin: ensureOrigin,
   hierarchyFor: hierarchyFor,
+  ownedWorkersByDriver: ownedWorkersByDriver,
   isWorker: isWorker,
   markWorker: markWorker,
   metadata: metadata,

package/lib/session-split-group-cleanup.js

@@ -0,0 +1,113 @@
+var splitRoles = require("./session-split-group-roles");
+var durableAnchors = require("./session-split-group-anchors");
+
+// Session deletion is irreversible, so its split-group effect is applied to
+// live membership before persistence and is never rolled back. A failed
+// write leaves the durable record pending: a bounded-backoff retry, or the
+// next successful save of any group, writes the authoritative live state.
+var DEFAULT_RETRY_DELAYS_MS = [1000, 5000, 15000, 60000];
+
+function refreshLiveAnchors(group, sessions) {
+  var member = durableAnchors.versionedMemberAnchors(group, sessions);
+  var pair = durableAnchors.versionedPairAnchors(group, sessions);
+  if (member) group.memberAnchors = member; else delete group.memberAnchors;
+  if (pair) group.pairAnchors = pair; else delete group.pairAnchors;
+}
+
+function removeDeletedMember(groups, localId, sessions) {
+  var index = -1;
+  for (var i = 0; i < groups.length; i++) {
+    if (groups[i].members.indexOf(localId) !== -1) { index = i; break; }
+  }
+  if (index === -1) return null;
+  var group = groups[index];
+  var normalized = splitRoles.normalizePair(group.pair, group.members);
+  if (normalized.ok && normalized.kind === "versioned" && normalized.driverId !== localId &&
+      normalized.workerIds.length > 1) {
+    var remaining = normalized.workerIds.filter(function (id) { return id !== localId; });
+    group.members = [normalized.driverId].concat(remaining);
+    group.pair = { version: 2, driverId: normalized.driverId, workerIds: remaining };
+    // Clients address Workers through these anchors by index, so they must
+    // match the reduced roles even while the durable write is pending.
+    refreshLiveAnchors(group, sessions);
+    return { group: group, dissolved: false };
+  }
+  groups.splice(index, 1);
+  return { group: group, dissolved: true };
+}
+
+function attachDeletionCleanup(opts) {
+  var delays = Array.isArray(opts.retryDelaysMs) && opts.retryDelaysMs.length ?
+    opts.retryDelaysMs.slice() : DEFAULT_RETRY_DELAYS_MS;
+  var setTimer = opts.setTimer || setTimeout;
+  var clearTimer = opts.clearTimer || clearTimeout;
+  var logger = opts.logger || console;
+  var pending = null;
+  var timer = null;
+  var stopped = false;
+
+  function cancelTimer() {
+    if (timer) clearTimer(timer);
+    timer = null;
+  }
+  function schedule() {
+    cancelTimer();
+    if (stopped || !pending) return;
+    timer = setTimer(retry, delays[Math.min(pending.attempts - 1, delays.length - 1)]);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  }
+  function recordFailure(reason, error) {
+    var message = error && error.message || String(error);
+    if (!pending) pending = { reason: reason, attempts: 0, since: Date.now(), lastError: null };
+    pending.attempts++;
+    pending.lastError = message;
+    logger.error("[split-groups] Durable split group state is pending after " + pending.reason +
+      " (attempt " + pending.attempts + "): " + message);
+    schedule();
+  }
+  function saved() {
+    if (!pending) return;
+    logger.log("[split-groups] Durable split group state recovered after " + pending.reason);
+    pending = null;
+    cancelTimer();
+  }
+  function persist(reason) {
+    try { opts.save(); return true; }
+    catch (error) { recordFailure(reason, error); return false; }
+  }
+  function retry() {
+    timer = null;
+    if (stopped || !pending) return;
+    persist(pending.reason);
+  }
+  function sessionDeleted(localId) {
+    var change = removeDeletedMember(opts.groups(), localId, opts.sessions);
+    if (!change) return false;
+    persist("session deletion");
+    opts.broadcast();
+    opts.onPairChanged(change.group);
+    return true;
+  }
+  function retryNow() {
+    if (!pending) return true;
+    return persist(pending.reason);
+  }
+  function status() {
+    if (!pending) return { pending: false };
+    return { pending: true, reason: pending.reason, attempts: pending.attempts,
+      since: pending.since, lastError: pending.lastError, retryScheduled: !!timer };
+  }
+  function shutdown() {
+    stopped = true;
+    cancelTimer();
+  }
+
+  return { sessionDeleted: sessionDeleted, recordFailure: recordFailure, saved: saved,
+    retryNow: retryNow, status: status, shutdown: shutdown };
+}
+
+module.exports = {
+  attachDeletionCleanup: attachDeletionCleanup,
+  removeDeletedMember: removeDeletedMember,
+  DEFAULT_RETRY_DELAYS_MS: DEFAULT_RETRY_DELAYS_MS,
+};

package/lib/session-split-group-persistence.js

@@ -2,6 +2,7 @@ var fs = require("fs");
 var path = require("path");
 var anchors = require("./session-split-group-anchors");
 var roles = require("./session-split-group-roles");
+var recovery = require("./session-split-group-recovery");
 
 var ANCHOR_KEYS = ["memberCliIds", "memberOriginIds", "pairCliIds", "pairOriginIds", "memberAnchors", "pairAnchors"];
 
@@ -9,6 +10,7 @@ function attachPersistence(opts) {
   var sessions = opts.sessions;
   var groupsFile = path.join(opts.sessionsDir, "split-groups.json");
   var preserved = [];
+  var loadRewriteError = null;
 
   function anchorPair(group) {
     if (!group.pair) return;
@@ -116,6 +118,12 @@ function attachPersistence(opts) {
       var versioned = !!(normalized && normalized.ok && normalized.kind === "versioned");
       if (versioned && !opts.versionedEnabled) { preserved.push(group); return false; }
       var resolved = versioned ? resolveVersioned(group, normalized) : resolveLegacy(group);
+      if (!resolved && versioned) {
+        resolved = recovery.repairDeletedMembers(group, normalized, sessions, {
+          loadUncertain: typeof opts.sessionLoadUncertain === "function" && opts.sessionLoadUncertain() === true,
+        });
+      }
+      if (resolved && resolved.drop) return false;
       if (!resolved) {
         if (versioned || group && roles.isUnsupportedPair(group.pair)) preserved.push(group);
         return false;
@@ -126,11 +134,16 @@ function attachPersistence(opts) {
       return true;
     });
     if (groups.length + preserved.length !== loaded.length) rewrite = true;
-    if (rewrite) save(groups);
+    loadRewriteError = null;
+    // A storage outage must not discard groups that resolved or were
+    // repaired in memory; the store retries the rewrite.
+    if (rewrite) {
+      try { save(groups); } catch (error) { loadRewriteError = error; }
+    }
     return groups;
   }
 
-  return { load: load, save: save };
+  return { load: load, save: save, loadRewriteError: function () { return loadRewriteError; } };
 }
 
 module.exports = { attachPersistence: attachPersistence };

package/lib/session-split-group-recovery.js

@@ -0,0 +1,87 @@
+var roles = require("./session-split-group-roles");
+
+// Restart repair for a Version 2 record whose deletion cleanup never reached
+// disk. Only anchors that no live session carries at all are treated as
+// deleted. Any ambiguous or partially matching identity, owner mismatch, or
+// disagreement between member and pair anchors leaves the record untouched so
+// the ordinary preserve-on-failure path still applies.
+
+function value(input) {
+  return typeof input === "string" && input ? input : null;
+}
+
+function sameAnchor(left, right) {
+  return !!(left && right && value(left.cli) === value(right.cli) && value(left.origin) === value(right.origin));
+}
+
+function classify(sessions, anchor) {
+  var cli = value(anchor && anchor.cli);
+  var origin = value(anchor && anchor.origin);
+  if (!cli && !origin) return { state: "invalid" };
+  var matches = [];
+  sessions.forEach(function (session) {
+    if ((cli && session.cliSessionId === cli) || (origin && session.sessionOriginId === origin)) matches.push(session);
+  });
+  if (matches.length === 0) return { state: "absent" };
+  var only = matches[0];
+  if (matches.length === 1 && (!cli || only.cliSessionId === cli) && (!origin || only.sessionOriginId === origin)) {
+    return { state: "exact", session: only };
+  }
+  return { state: "conflict" };
+}
+
+function agreedAnchors(group, normalized) {
+  var members = group.memberAnchors;
+  var pair = group.pairAnchors;
+  if (!members || members.version !== 2 || !Array.isArray(members.members)) return null;
+  if (!pair || pair.version !== 2 || !pair.driver || !Array.isArray(pair.workers)) return null;
+  if (pair.workers.length !== normalized.workerIds.length || members.members.length !== group.members.length) return null;
+  if (members.members.length !== pair.workers.length + 1 || !sameAnchor(members.members[0], pair.driver)) return null;
+  for (var i = 0; i < pair.workers.length; i++) {
+    if (!sameAnchor(members.members[i + 1], pair.workers[i])) return null;
+  }
+  return { driver: pair.driver, workers: pair.workers };
+}
+
+// Returns null when no safe repair applies, { drop: true } when the stored
+// Driver or every Worker was deleted, or { changed: true } after reducing the
+// record to its exact surviving Driver and Workers. An absent anchor is
+// evidence of deletion only when every session record was read; after any
+// unreadable or unparseable record the stored group is preserved unchanged.
+function repairDeletedMembers(group, normalized, sessions, options) {
+  if (typeof group.id !== "string" || !group.id || !normalized.ok || normalized.kind !== "versioned") return null;
+  var agreed = agreedAnchors(group, normalized);
+  if (!agreed) return null;
+  var ownerId = group.ownerId || null;
+  var driver = classify(sessions, agreed.driver);
+  var workers = agreed.workers.map(function (anchor) { return classify(sessions, anchor); });
+  var all = [driver].concat(workers);
+  var absent = 0;
+  var seen = [];
+  for (var i = 0; i < all.length; i++) {
+    if (all[i].state === "absent") { absent++; continue; }
+    if (all[i].state !== "exact") return null;
+    if ((all[i].session.ownerId || null) !== ownerId || seen.indexOf(all[i].session) !== -1) return null;
+    seen.push(all[i].session);
+  }
+  if (absent === 0 || (options && options.loadUncertain)) return null;
+  var survivors = [];
+  var survivorAnchors = [];
+  for (var j = 0; j < workers.length; j++) {
+    if (workers[j].state !== "exact") continue;
+    survivors.push(workers[j].session);
+    survivorAnchors.push(agreed.workers[j]);
+  }
+  if (driver.state !== "exact" || survivors.length === 0) return { drop: true };
+  var memberIds = [driver.session.localId].concat(survivors.map(function (session) { return session.localId; }));
+  var nextPair = { version: 2, driverId: driver.session.localId, workerIds: memberIds.slice(1) };
+  var checked = roles.normalizePair(nextPair, memberIds);
+  if (!checked.ok || checked.kind !== "versioned") return null;
+  group.members = memberIds;
+  group.pair = nextPair;
+  group.memberAnchors = { version: 2, members: [agreed.driver].concat(survivorAnchors) };
+  group.pairAnchors = { version: 2, driver: agreed.driver, workers: survivorAnchors };
+  return { changed: true };
+}
+
+module.exports = { repairDeletedMembers: repairDeletedMembers, classifyAnchor: classify };

package/lib/session-split-groups.js

@@ -4,6 +4,7 @@ var splitRoles = require("./session-split-group-roles");
 var versionedStore = require("./session-split-group-v2-store");
 var multiWorkerFeature = require("./multi-worker-feature");
 var groupPersistence = require("./session-split-group-persistence");
+var deletionCleanup = require("./session-split-group-cleanup");
 function truncateTitle(title) {
   var value = String(title || "New Session");
   return value.length > 20 ? value.slice(0, 19) + "…" : value;
@@ -20,7 +21,15 @@ function createSplitGroupStore(opts) {
   var stagedTransfers = [];
   var versionedEnabled = multiWorkerFeature.isEnabled(opts.multiWorkerFeature);
   var persistence = groupPersistence.attachPersistence(Object.assign({}, opts, { versionedEnabled: versionedEnabled }));
-  function save() { return persistence.save(groups); }
+  var cleanup = deletionCleanup.attachDeletionCleanup({
+    sessions: sessions, groups: function () { return groups; }, save: save,
+    broadcast: function () { broadcast(); }, onPairChanged: function (group) { onPairChanged(group); },
+    retryDelaysMs: opts.persistRetryDelaysMs, setTimer: opts.setTimer, clearTimer: opts.clearTimer, logger: opts.logger,
+  });
+  function save() {
+    persistence.save(groups);
+    cleanup.saved();
+  }
   function isMultiUser() {
     return !!(usersModule && usersModule.isMultiUser && usersModule.isMultiUser());
   }
@@ -354,33 +363,8 @@ function createSplitGroupStore(opts) {
     return { ok: true, group: removed };
   }
 
-  function dissolveBySession(localId) {
-    var index = groups.findIndex(function (group) { return group.members.indexOf(localId) !== -1; });
-    if (index === -1) return false;
-    var group = groups[index];
-    var normalized = splitRoles.normalizePair(group.pair, group.members);
-    var beforeMembers = group.members.slice();
-    var beforePair = group.pair && Object.assign({}, group.pair);
-    if (beforePair && Array.isArray(beforePair.workerIds)) beforePair.workerIds = beforePair.workerIds.slice();
-    var removed = null;
-    if (normalized.ok && normalized.kind === "versioned" && normalized.driverId !== localId &&
-        normalized.workerIds.length > 1) {
-      var remaining = normalized.workerIds.filter(function (id) { return id !== localId; });
-      group.members = [normalized.driverId].concat(remaining);
-      group.pair = { version: 2, driverId: normalized.driverId, workerIds: remaining };
-    } else {
-      removed = groups.splice(index, 1)[0];
-    }
-    try { save(); }
-    catch (error) {
-      if (removed) groups.splice(index, 0, removed);
-      else { group.members = beforeMembers; group.pair = beforePair; }
-      return false;
-    }
-    broadcast();
-    onPairChanged(group);
-    return true;
-  }
+  // Deletion cleanup is irreversible; see session-split-group-cleanup.js.
+  function dissolveBySession(localId) { return cleanup.sessionDeleted(localId); }
 
   function refreshAnchors(localId) {
     var group = groupForMember(localId);
@@ -457,6 +441,7 @@ function createSplitGroupStore(opts) {
     changed: versionedChanged,
   });
   groups = persistence.load();
+  if (persistence.loadRewriteError()) cleanup.recordFailure("startup rewrite", persistence.loadRewriteError());
   return { create: create, createOwned: createOwned, dissolveOwned: dissolveOwned,
     beginOwnedDriverTransfer: beginOwnedDriverTransfer, commitOwnedDriverTransfer: commitOwnedDriverTransfer,
     rollbackOwnedDriverTransfer: rollbackOwnedDriverTransfer,
@@ -464,6 +449,7 @@ function createSplitGroupStore(opts) {
     addWorker: versionedMutations.addWorker, replaceWorker: versionedMutations.replaceWorker,
     removeWorker: versionedMutations.removeWorker,
     refreshAutoName: refreshAutoName, refreshAnchors: refreshAnchors,
+    persistenceStatus: cleanup.status, retryPersistence: cleanup.retryNow, shutdown: cleanup.shutdown,
     listFor: listFor, groupForMember: groupForMember, get groups() { return groups; } };
 }
 
@@ -475,6 +461,7 @@ function attachSplitGroups(ctx) {
     broadcast: broadcast,
     onPairChanged: ctx.onPairChanged,
     multiWorkerFeature: ctx.multiWorkerFeature,
+    sessionLoadUncertain: ctx.sm.sessionLoadUncertain,
   });
 
   function sendState(ws) {
@@ -503,7 +490,7 @@ function attachSplitGroups(ctx) {
   ctx.sm.setOnSessionDeleted(store.dissolveBySession);
   ctx.sm.setOnSessionRenamed(store.refreshAutoName);
   ctx.sm.setOnSessionIdentityAssigned(store.refreshAnchors);
-  return { handleMessage: handleMessage, sendConnectionState: sendState, store: store };
+  return { handleMessage: handleMessage, sendConnectionState: sendState, store: store, shutdown: store.shutdown };
 }
 
 module.exports = { attachSplitGroups: attachSplitGroups, createSplitGroupStore: createSplitGroupStore, autoGroupName: autoGroupName };

package/lib/sessions.js

@@ -271,9 +271,16 @@ function createSessionManager(opts) {
     return null;
   }
 
+  // Records that could not be read or parsed may still be live sessions.
+  // Split-group recovery reads this so it never treats them as deleted.
+  var sessionLoadUncertain = false;
+
   function loadSessions() {
     var files;
-    try { files = fs.readdirSync(sessionsDir); } catch { return; }
+    try { files = fs.readdirSync(sessionsDir); } catch (e) {
+      if (!e || e.code !== "ENOENT") sessionLoadUncertain = true;
+      return;
+    }
 
     // Clean up stale temp files from interrupted atomic writes
     for (var ti = 0; ti < files.length; ti++) {
@@ -286,14 +293,14 @@ function createSessionManager(opts) {
     for (var i = 0; i < files.length; i++) {
       if (!files[i].endsWith(".jsonl")) continue;
       var content;
-      try { content = fs.readFileSync(path.join(sessionsDir, files[i]), "utf8"); } catch { continue; }
+      try { content = fs.readFileSync(path.join(sessionsDir, files[i]), "utf8"); } catch { sessionLoadUncertain = true; continue; }
       var lines = content.trim().split("\n");
       if (lines.length === 0) continue;
 
       var meta;
-      try { meta = JSON.parse(lines[0]); } catch { continue; }
-      var pendingOrigin = typeof meta.sessionOriginId === "string" && meta.sessionOriginId.trim() && meta.sessionOriginId.length <= 128;
-      if (meta.type !== "meta" || (!meta.cliSessionId && !pendingOrigin)) continue;
+      try { meta = JSON.parse(lines[0]); } catch { sessionLoadUncertain = true; continue; }
+      var pendingOrigin = meta && typeof meta.sessionOriginId === "string" && meta.sessionOriginId.trim() && meta.sessionOriginId.length <= 128;
+      if (!meta || meta.type !== "meta" || (!meta.cliSessionId && !pendingOrigin)) { sessionLoadUncertain = true; continue; }
 
       var history = [];
       for (var j = 1; j < lines.length; j++) {
@@ -632,11 +639,25 @@ function createSessionManager(opts) {
     };
   }
 
-  function mapSessionsForClient(source, clientActiveId, wsUnread) {
+  // Counted over every session, including hidden ones, so delete
+  // confirmations can state the full cascade. In multi-user mode only the
+  // Driver's own owner receives it: another viewer could otherwise infer
+  // hidden or private Workers, and a missing count means "unknown" to the
+  // client, never zero. viewerId must come from the authenticated socket.
+  function ownedWorkerCountFor(session, node, owned, viewerId) {
+    if (node.role !== "driver") return 0;
+    if (users.isMultiUser() && (!viewerId || (session.ownerId || null) !== viewerId)) return undefined;
+    return owned[session.localId] ? owned[session.localId].length : 0;
+  }
+
+  function mapSessionsForClient(source, clientActiveId, wsUnread, viewerId) {
     var hierarchy = sessionProvenance.hierarchyFor(source);
+    var owned = sessionProvenance.ownedWorkersByDriver([...sessions.values()]);
     return source.map(function (session) {
       var mapped = mapSessionForClient(session, clientActiveId, wsUnread);
       var node = hierarchy[session.localId];
+      var ownedCount = ownedWorkerCountFor(session, node, owned, viewerId);
+      if (ownedCount !== undefined) mapped.ownedWorkerCount = ownedCount;
       mapped.sessionRole = node.role;
       mapped.parentSessionId = node.parentSessionId;
       mapped.parentAvailable = node.parentAvailable;
@@ -667,7 +688,7 @@ function createSessionManager(opts) {
         if (ws.readyState === 1) {
           ws.send(JSON.stringify({
             type: "session_list",
-            sessions: mapSessionsForClient(filtered, clientActiveId, wsUnread),
+            sessions: mapSessionsForClient(filtered, clientActiveId, wsUnread, ws._clayUser ? ws._clayUser.id : null),
           }));
         }
       });
@@ -1389,6 +1410,7 @@ function createSessionManager(opts) {
     set codexWebSearch(v) { codexWebSearch = v; },
     sessions: sessions,
     sessionsDir: sessionsDir,
+    sessionLoadUncertain: function () { return sessionLoadUncertain; },
     setOnSessionDeleted: function (fn) { onSessionDeleted = fn || function () {}; },
     addOnSessionDeleted: function (fn) { if (typeof fn === "function") sessionDeletedListeners.push(fn); },
     addOnSessionViewed: function (fn) { if (typeof fn === "function") sessionViewedListeners.push(fn); },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.3.1-beta.1",
+  "version": "4.3.1-beta.3",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"