clay-server 4.3.1-beta.2 → 4.3.1-beta.3

package/lib/project-connection.js

@@ -244,7 +244,7 @@ function attachConnection(ctx) {
     // so vendor badges showed Claude until the next broadcast).
     sendTo(ws, {
       type: "session_list",
-      sessions: sm.mapSessionsForClient(allSessions),
+      sessions: sm.mapSessionsForClient(allSessions, undefined, undefined, wsUser ? wsUser.id : null),
     });
     if (_splitGroups) _splitGroups.sendConnectionState(ws);
 

package/lib/project-session-delete.js

@@ -0,0 +1,101 @@
+var sessionProvenance = require("./session-provenance");
+
+// Explicit human deletion of a Driver also removes every Split Worker
+// generation it durably owns. Ownership comes only from the provenance
+// hierarchy: a unique parent origin, the same owner, and a parent that is not
+// itself a Worker. Ambiguous or cross-owner links are never expanded. Close,
+// dissolve, and replacement do not come through here and keep history, and
+// deleting a Worker never removes its Driver or siblings.
+
+function resolveDeletionScope(sessions, requested, canDelete) {
+  var workersByDriver = sessionProvenance.ownedWorkersByDriver(Array.from(sessions.values()));
+  var ids = [];
+  var cascadedIds = [];
+  var seen = {};
+  function add(session, cascaded) {
+    if (seen[session.localId]) return;
+    seen[session.localId] = true;
+    ids.push(session.localId);
+    if (cascaded) cascadedIds.push(session.localId);
+  }
+  for (var j = 0; j < requested.length; j++) {
+    var target = requested[j];
+    add(target, false);
+    if (sessionProvenance.isWorker(target)) continue;
+    var owned = workersByDriver[target.localId] || [];
+    for (var k = 0; k < owned.length; k++) {
+      // The whole scope is authorized before anything is removed.
+      if (!canDelete(owned[k])) {
+        return { ok: false, error: "You cannot delete this Driver because one of its Split Worker sessions is not accessible to you" };
+      }
+      add(owned[k], true);
+    }
+  }
+  return { ok: true, ids: ids, cascadedIds: cascadedIds };
+}
+
+function attachSessionDelete(ctx) {
+  var sm = ctx.sm;
+  var usersModule = ctx.usersModule;
+  var getProjectAccess = ctx.getProjectAccess || function () { return { visibility: "public" }; };
+
+  function hasDeletePermission(ws) {
+    if (!ws._clayUser) return true;
+    return !!usersModule.getEffectivePermissions(ws._clayUser, ctx.osUsers).sessionDelete;
+  }
+  function accessCheck(ws, access) {
+    return function (session) {
+      if (!usersModule.isMultiUser()) return true;
+      return !!(ws._clayUser && usersModule.canAccessSession(ws._clayUser.id, session, access));
+    };
+  }
+  function releaseRuntime(ids) {
+    for (var i = 0; i < ids.length; i++) {
+      var session = sm.sessions.get(ids[i]);
+      if (!session) continue;
+      // TUI sessions: reap the PTY and stop title watchers before the
+      // records are wiped so no `claude` process is left orphaned.
+      if (ctx.tm && session.mode === "tui" && typeof session.terminalId === "number") {
+        try { ctx.tm.close(session.terminalId); } catch (e) {}
+      }
+      ctx.stopTitleWatcher(session);
+    }
+  }
+  function refuse(ws, text) {
+    ctx.sendTo(ws, { type: "error", text: text });
+  }
+
+  function deleteSession(ws, msg) {
+    if (!hasDeletePermission(ws)) return refuse(ws, "You do not have permission to delete sessions");
+    if (!msg.id || !sm.sessions.has(msg.id)) return;
+    var target = sm.sessions.get(msg.id);
+    var canDelete = accessCheck(ws, getProjectAccess());
+    if (!canDelete(target)) return;
+    var scope = resolveDeletionScope(sm.sessions, [target], canDelete);
+    if (!scope.ok) return refuse(ws, scope.error);
+    releaseRuntime(scope.ids);
+    if (scope.ids.length === 1) sm.deleteSession(target.localId, ws);
+    else sm.deleteSessionsBulk(scope.ids, ws);
+  }
+
+  function bulkDeleteSessions(ws, msg) {
+    if (!Array.isArray(msg.sessionIds) || msg.sessionIds.length === 0) return;
+    if (!hasDeletePermission(ws)) return refuse(ws, "You do not have permission to delete sessions");
+    var canDelete = accessCheck(ws, { visibility: "public" });
+    var requested = [];
+    for (var i = 0; i < msg.sessionIds.length; i++) {
+      var id = msg.sessionIds[i];
+      var target = typeof id === "number" ? sm.sessions.get(id) : null;
+      if (target && canDelete(target)) requested.push(target);
+    }
+    if (requested.length === 0) return;
+    var scope = resolveDeletionScope(sm.sessions, requested, canDelete);
+    if (!scope.ok) return refuse(ws, scope.error);
+    releaseRuntime(scope.ids);
+    sm.deleteSessionsBulk(scope.ids, ws);
+  }
+
+  return { deleteSession: deleteSession, bulkDeleteSessions: bulkDeleteSessions };
+}
+
+module.exports = { attachSessionDelete: attachSessionDelete, resolveDeletionScope: resolveDeletionScope };

package/lib/project-sessions.js

@@ -7,6 +7,7 @@ var updateSnooze = require("./update-snooze");
 var yoke = require("./yoke");
 var sessionVisibility = require("./session-visibility");
 var contextUsageModule = require("./context-usage");
+var sessionDeleteModule = require("./project-session-delete");
 
 function vendorSupportsTui(vendor) {
   var info = yoke.getVendorInfo(vendor);
@@ -337,6 +338,11 @@ function attachSessions(ctx) {
     }
   }
 
+  var sessionDelete = sessionDeleteModule.attachSessionDelete({
+    sm: sm, usersModule: usersModule, osUsers: osUsers, tm: tm, sendTo: sendTo,
+    getProjectAccess: getProjectAccess, stopTitleWatcher: stopTitleWatcher,
+  });
+
   // Kick off watchers for any TUI sessions already loaded from disk so
   // their titles refresh as soon as Claude Code rewrites the jsonl, even
   // before the user clicks them.
@@ -779,31 +785,7 @@ function attachSessions(ctx) {
     }
 
     if (msg.type === "bulk_delete_sessions") {
-      if (!Array.isArray(msg.sessionIds) || msg.sessionIds.length === 0) return true;
-      var deletableIds = [];
-      for (var di = 0; di < msg.sessionIds.length; di++) {
-        var bulkId = msg.sessionIds[di];
-        if (typeof bulkId !== "number") continue;
-        var bulkTarget = sm.sessions.get(bulkId);
-        if (!bulkTarget) continue;
-        if (usersModule.isMultiUser() && ws._clayUser) {
-          if (!usersModule.canAccessSession(ws._clayUser.id, bulkTarget, { visibility: "public" })) continue;
-        }
-        deletableIds.push(bulkId);
-      }
-      if (deletableIds.length > 0) {
-        // TUI sessions: kill their PTYs and stop title watchers before the
-        // records are wiped.
-        for (var bdi = 0; bdi < deletableIds.length; bdi++) {
-          var bdTarget = sm.sessions.get(deletableIds[bdi]);
-          if (!bdTarget) continue;
-          if (tm && bdTarget.mode === "tui" && typeof bdTarget.terminalId === "number") {
-            try { tm.close(bdTarget.terminalId); } catch (e) {}
-          }
-          stopTitleWatcher(bdTarget);
-        }
-        sm.deleteSessionsBulk(deletableIds, ws);
-      }
+      sessionDelete.bulkDeleteSessions(ws, msg);
       return true;
     }
 
@@ -978,25 +960,7 @@ function attachSessions(ctx) {
     }
 
     if (msg.type === "delete_session") {
-      if (ws._clayUser) {
-        var sdPerms = usersModule.getEffectivePermissions(ws._clayUser, osUsers);
-        if (!sdPerms.sessionDelete) {
-          sendTo(ws, { type: "error", text: "You do not have permission to delete sessions" });
-          return true;
-        }
-      }
-      if (msg.id && sm.sessions.has(msg.id)) {
-        // TUI session: kill the underlying PTY before deleting the session
-        // record so the `claude` process is reaped and not left orphaned.
-        var dsTarget = sm.sessions.get(msg.id);
-        if (usersModule.isMultiUser() && (!ws._clayUser ||
-            !usersModule.canAccessSession(ws._clayUser.id, dsTarget, getProjectAccess()))) return true;
-        if (dsTarget && dsTarget.mode === "tui" && typeof dsTarget.terminalId === "number" && tm) {
-          try { tm.close(dsTarget.terminalId); } catch (e) {}
-        }
-        if (dsTarget) stopTitleWatcher(dsTarget);
-        sm.deleteSession(msg.id, ws);
-      }
+      sessionDelete.deleteSession(ws, msg);
       return true;
     }
 

package/lib/project.js

@@ -2568,6 +2568,7 @@ function createProjectContext(opts) {
   function destroy() {
     if (_scheduledMessages) _scheduledMessages.shutdown();
     if (_autonomousRun) _autonomousRun.shutdown();
+    _splitGroups.shutdown();
     _loop.stopTimer();
     _email.destroy();
     stopFileWatch();

package/lib/public/modules/session-delete-scope.js

@@ -0,0 +1,96 @@
+// Describes the server deletion scope so confirmations never understate it.
+// Deleting a Driver also deletes every Split Worker session it owns,
+// including hidden sessions and previous generations. The server sends that
+// full total as `ownedWorkerCount`; the visible list alone can miss hidden
+// Workers, so it never stands in for the total. When the total is unknown,
+// the wording says so and a dialog is required. Deleting a Worker affects only
+// that Worker.
+
+var FULL_SCOPE = "including hidden sessions and previous generations";
+
+export function ownedWorkerIds(driverId, sessions) {
+  var list = Array.isArray(sessions) ? sessions : [];
+  var ids = [];
+  for (var i = 0; i < list.length; i++) {
+    var session = list[i];
+    if (session && session.sessionRole === "worker" && session.parentAvailable && session.parentSessionId === driverId) {
+      ids.push(session.id);
+    }
+  }
+  return ids;
+}
+
+function findSession(sessionId, sessions) {
+  var list = Array.isArray(sessions) ? sessions : [];
+  for (var i = 0; i < list.length; i++) if (list[i] && list[i].id === sessionId) return list[i];
+  return null;
+}
+
+// { worker: true } | { known: true, visible, total } | { known: false, visible }
+function ownership(session, sessions) {
+  if (!session) return { known: false, visible: [] };
+  if (session.sessionRole === "worker") return { worker: true, visible: [] };
+  var visible = ownedWorkerIds(session.id, sessions);
+  if (typeof session.ownedWorkerCount !== "number" || session.ownedWorkerCount < 0) return { known: false, visible: visible };
+  return { known: true, visible: visible, total: Math.max(session.ownedWorkerCount, visible.length) };
+}
+
+function workerPhrase(count) {
+  return count + " Split Worker " + (count === 1 ? "session" : "sessions");
+}
+
+export function describeSessionDelete(session, sessions) {
+  var cached = session ? findSession(session.id, sessions) : null;
+  var resolved = cached || (session && session.sessionRole ? session : null);
+  var title = (session && session.title) || (cached && cached.title) || "New Session";
+  var base = 'Delete "' + title + '"? ';
+  var owner = ownership(resolved, sessions);
+  if (owner.worker || (owner.known && owner.total === 0)) {
+    return { workerCount: 0, requiresDialog: false, message: base + "This session and its history will be permanently removed." };
+  }
+  if (owner.known) {
+    return { workerCount: owner.total, requiresDialog: true,
+      message: base + "This Driver and all " + workerPhrase(owner.total) + " it owns, " + FULL_SCOPE +
+        ", will be permanently removed with their history." };
+  }
+  return { workerCount: null, requiresDialog: true,
+    message: base + "This session and its history will be permanently removed. If it is a Driver, every Split Worker session it owns, " +
+      FULL_SCOPE + ", will also be permanently removed." };
+}
+
+export function describeGroupDelete(groupLabel, sessionIds, sessions) {
+  var requested = [];
+  var seen = new Set();
+  var list = Array.isArray(sessionIds) ? sessionIds : [];
+  for (var r = 0; r < list.length; r++) {
+    if (seen.has(list[r])) continue;
+    seen.add(list[r]);
+    requested.push(list[r]);
+  }
+  var ids = requested.slice();
+  var hidden = 0;
+  var unknown = 0;
+  for (var i = 0; i < requested.length; i++) {
+    var owner = ownership(findSession(requested[i], sessions), sessions);
+    if (owner.worker) continue;
+    for (var j = 0; j < owner.visible.length; j++) {
+      if (seen.has(owner.visible[j])) continue;
+      seen.add(owner.visible[j]);
+      ids.push(owner.visible[j]);
+    }
+    if (owner.known) hidden += owner.total - owner.visible.length;
+    else unknown++;
+  }
+  var cascaded = ids.length - requested.length + hidden;
+  var total = ids.length + hidden;
+  var noun = total === 1 ? "session" : "sessions";
+  var message = 'Clear "' + groupLabel + '"? ';
+  if (unknown > 0) {
+    message += "At least " + total + " " + noun + " will be permanently removed, plus every Split Worker session owned by a Driver here, " + FULL_SCOPE + ".";
+  } else {
+    message += total + " " + noun + " will be permanently removed";
+    if (cascaded > 0) message += ", including " + workerPhrase(cascaded) + " owned by these Drivers, " + FULL_SCOPE;
+    message += ".";
+  }
+  return { ids: ids, cascadedCount: cascaded, exact: unknown === 0, message: message };
+}

package/lib/public/modules/sidebar-sessions.js

@@ -18,6 +18,7 @@ import { groupedSessionIds } from './split-group-helpers.js';
 import { defaultVendorUnavailable, resolvePreferredVendor, saveDefaultVendor } from './default-vendor.js';
 import { openPairDialog } from './split-pair-ui.js';
 import { renderSessionCreationCta } from './session-creation-cta.js';
+import { describeSessionDelete, describeGroupDelete } from './session-delete-scope.js';
 import {
   hierarchyItemMatches,
   prepareSidebarHierarchy,
@@ -192,7 +193,7 @@ function spawnSessionDeleteParticles(sessionId) {
 }
 
 function confirmDeleteSession(session) {
-  showConfirm('Delete "' + (session.title || "New Session") + '"? This session and its history will be permanently removed.', function () {
+  showConfirm(describeSessionDelete(session, cachedSessions).message, function () {
     var ws = getWs();
     if (ws && store.get('connected')) {
       ws.send(JSON.stringify({ type: "delete_session", id: session.id }));
@@ -271,9 +272,7 @@ function collectItemSessionIds(item) {
 
 function confirmDeleteSessionGroup(groupLabel, sessionIds) {
   if (!Array.isArray(sessionIds) || sessionIds.length === 0) return;
-  var count = sessionIds.length;
-  var noun = count === 1 ? "session" : "sessions";
-  showConfirm('Clear "' + groupLabel + '"? ' + count + " " + noun + ' will be permanently removed.', function () {
+  showConfirm(describeGroupDelete(groupLabel, sessionIds, cachedSessions).message, function () {
     var ws = getWs();
     if (ws && store.get('connected')) {
       ws.send(JSON.stringify({ type: "bulk_delete_sessions", sessionIds: sessionIds }));
@@ -319,6 +318,13 @@ function appendSessionCloseButton(el, session) {
   closeBtn.addEventListener("click", function (e) {
     e.preventDefault();
     e.stopPropagation();
+    // A deletion that removes or may remove Split Workers always gets the
+    // explicit dialog instead of the two-click armed shortcut.
+    if (describeSessionDelete(session, cachedSessions).requiresDialog) {
+      clearArmedSessionDelete();
+      confirmDeleteSession(session);
+      return;
+    }
     if (armedDeleteSessionId === session.id) {
       clearArmedSessionDelete();
       deleteSessionImmediately(session);

package/lib/session-provenance.js

@@ -110,9 +110,25 @@ function hierarchyFor(sessions) {
   return result;
 }
 
+// Every Worker the hierarchy links to each Driver, keyed by Driver local id.
+// This is the exact scope a Driver deletion cascades to, including hidden
+// sessions and replaced generations.
+function ownedWorkersByDriver(sessions) {
+  var hierarchy = hierarchyFor(sessions);
+  var result = {};
+  for (var i = 0; i < sessions.length; i++) {
+    var node = hierarchy[sessions[i].localId];
+    if (!node || node.role !== "worker" || node.parentSessionId == null) continue;
+    if (!result[node.parentSessionId]) result[node.parentSessionId] = [];
+    result[node.parentSessionId].push(sessions[i]);
+  }
+  return result;
+}
+
 module.exports = {
   ensureOrigin: ensureOrigin,
   hierarchyFor: hierarchyFor,
+  ownedWorkersByDriver: ownedWorkersByDriver,
   isWorker: isWorker,
   markWorker: markWorker,
   metadata: metadata,

package/lib/session-split-group-cleanup.js

@@ -0,0 +1,113 @@
+var splitRoles = require("./session-split-group-roles");
+var durableAnchors = require("./session-split-group-anchors");
+
+// Session deletion is irreversible, so its split-group effect is applied to
+// live membership before persistence and is never rolled back. A failed
+// write leaves the durable record pending: a bounded-backoff retry, or the
+// next successful save of any group, writes the authoritative live state.
+var DEFAULT_RETRY_DELAYS_MS = [1000, 5000, 15000, 60000];
+
+function refreshLiveAnchors(group, sessions) {
+  var member = durableAnchors.versionedMemberAnchors(group, sessions);
+  var pair = durableAnchors.versionedPairAnchors(group, sessions);
+  if (member) group.memberAnchors = member; else delete group.memberAnchors;
+  if (pair) group.pairAnchors = pair; else delete group.pairAnchors;
+}
+
+function removeDeletedMember(groups, localId, sessions) {
+  var index = -1;
+  for (var i = 0; i < groups.length; i++) {
+    if (groups[i].members.indexOf(localId) !== -1) { index = i; break; }
+  }
+  if (index === -1) return null;
+  var group = groups[index];
+  var normalized = splitRoles.normalizePair(group.pair, group.members);
+  if (normalized.ok && normalized.kind === "versioned" && normalized.driverId !== localId &&
+      normalized.workerIds.length > 1) {
+    var remaining = normalized.workerIds.filter(function (id) { return id !== localId; });
+    group.members = [normalized.driverId].concat(remaining);
+    group.pair = { version: 2, driverId: normalized.driverId, workerIds: remaining };
+    // Clients address Workers through these anchors by index, so they must
+    // match the reduced roles even while the durable write is pending.
+    refreshLiveAnchors(group, sessions);
+    return { group: group, dissolved: false };
+  }
+  groups.splice(index, 1);
+  return { group: group, dissolved: true };
+}
+
+function attachDeletionCleanup(opts) {
+  var delays = Array.isArray(opts.retryDelaysMs) && opts.retryDelaysMs.length ?
+    opts.retryDelaysMs.slice() : DEFAULT_RETRY_DELAYS_MS;
+  var setTimer = opts.setTimer || setTimeout;
+  var clearTimer = opts.clearTimer || clearTimeout;
+  var logger = opts.logger || console;
+  var pending = null;
+  var timer = null;
+  var stopped = false;
+
+  function cancelTimer() {
+    if (timer) clearTimer(timer);
+    timer = null;
+  }
+  function schedule() {
+    cancelTimer();
+    if (stopped || !pending) return;
+    timer = setTimer(retry, delays[Math.min(pending.attempts - 1, delays.length - 1)]);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  }
+  function recordFailure(reason, error) {
+    var message = error && error.message || String(error);
+    if (!pending) pending = { reason: reason, attempts: 0, since: Date.now(), lastError: null };
+    pending.attempts++;
+    pending.lastError = message;
+    logger.error("[split-groups] Durable split group state is pending after " + pending.reason +
+      " (attempt " + pending.attempts + "): " + message);
+    schedule();
+  }
+  function saved() {
+    if (!pending) return;
+    logger.log("[split-groups] Durable split group state recovered after " + pending.reason);
+    pending = null;
+    cancelTimer();
+  }
+  function persist(reason) {
+    try { opts.save(); return true; }
+    catch (error) { recordFailure(reason, error); return false; }
+  }
+  function retry() {
+    timer = null;
+    if (stopped || !pending) return;
+    persist(pending.reason);
+  }
+  function sessionDeleted(localId) {
+    var change = removeDeletedMember(opts.groups(), localId, opts.sessions);
+    if (!change) return false;
+    persist("session deletion");
+    opts.broadcast();
+    opts.onPairChanged(change.group);
+    return true;
+  }
+  function retryNow() {
+    if (!pending) return true;
+    return persist(pending.reason);
+  }
+  function status() {
+    if (!pending) return { pending: false };
+    return { pending: true, reason: pending.reason, attempts: pending.attempts,
+      since: pending.since, lastError: pending.lastError, retryScheduled: !!timer };
+  }
+  function shutdown() {
+    stopped = true;
+    cancelTimer();
+  }
+
+  return { sessionDeleted: sessionDeleted, recordFailure: recordFailure, saved: saved,
+    retryNow: retryNow, status: status, shutdown: shutdown };
+}
+
+module.exports = {
+  attachDeletionCleanup: attachDeletionCleanup,
+  removeDeletedMember: removeDeletedMember,
+  DEFAULT_RETRY_DELAYS_MS: DEFAULT_RETRY_DELAYS_MS,
+};

package/lib/session-split-group-persistence.js

@@ -2,6 +2,7 @@ var fs = require("fs");
 var path = require("path");
 var anchors = require("./session-split-group-anchors");
 var roles = require("./session-split-group-roles");
+var recovery = require("./session-split-group-recovery");
 
 var ANCHOR_KEYS = ["memberCliIds", "memberOriginIds", "pairCliIds", "pairOriginIds", "memberAnchors", "pairAnchors"];
 
@@ -9,6 +10,7 @@ function attachPersistence(opts) {
   var sessions = opts.sessions;
   var groupsFile = path.join(opts.sessionsDir, "split-groups.json");
   var preserved = [];
+  var loadRewriteError = null;
 
   function anchorPair(group) {
     if (!group.pair) return;
@@ -116,6 +118,12 @@ function attachPersistence(opts) {
       var versioned = !!(normalized && normalized.ok && normalized.kind === "versioned");
       if (versioned && !opts.versionedEnabled) { preserved.push(group); return false; }
       var resolved = versioned ? resolveVersioned(group, normalized) : resolveLegacy(group);
+      if (!resolved && versioned) {
+        resolved = recovery.repairDeletedMembers(group, normalized, sessions, {
+          loadUncertain: typeof opts.sessionLoadUncertain === "function" && opts.sessionLoadUncertain() === true,
+        });
+      }
+      if (resolved && resolved.drop) return false;
       if (!resolved) {
         if (versioned || group && roles.isUnsupportedPair(group.pair)) preserved.push(group);
         return false;
@@ -126,11 +134,16 @@ function attachPersistence(opts) {
       return true;
     });
     if (groups.length + preserved.length !== loaded.length) rewrite = true;
-    if (rewrite) save(groups);
+    loadRewriteError = null;
+    // A storage outage must not discard groups that resolved or were
+    // repaired in memory; the store retries the rewrite.
+    if (rewrite) {
+      try { save(groups); } catch (error) { loadRewriteError = error; }
+    }
     return groups;
   }
 
-  return { load: load, save: save };
+  return { load: load, save: save, loadRewriteError: function () { return loadRewriteError; } };
 }
 
 module.exports = { attachPersistence: attachPersistence };

package/lib/session-split-group-recovery.js

@@ -0,0 +1,87 @@
+var roles = require("./session-split-group-roles");
+
+// Restart repair for a Version 2 record whose deletion cleanup never reached
+// disk. Only anchors that no live session carries at all are treated as
+// deleted. Any ambiguous or partially matching identity, owner mismatch, or
+// disagreement between member and pair anchors leaves the record untouched so
+// the ordinary preserve-on-failure path still applies.
+
+function value(input) {
+  return typeof input === "string" && input ? input : null;
+}
+
+function sameAnchor(left, right) {
+  return !!(left && right && value(left.cli) === value(right.cli) && value(left.origin) === value(right.origin));
+}
+
+function classify(sessions, anchor) {
+  var cli = value(anchor && anchor.cli);
+  var origin = value(anchor && anchor.origin);
+  if (!cli && !origin) return { state: "invalid" };
+  var matches = [];
+  sessions.forEach(function (session) {
+    if ((cli && session.cliSessionId === cli) || (origin && session.sessionOriginId === origin)) matches.push(session);
+  });
+  if (matches.length === 0) return { state: "absent" };
+  var only = matches[0];
+  if (matches.length === 1 && (!cli || only.cliSessionId === cli) && (!origin || only.sessionOriginId === origin)) {
+    return { state: "exact", session: only };
+  }
+  return { state: "conflict" };
+}
+
+function agreedAnchors(group, normalized) {
+  var members = group.memberAnchors;
+  var pair = group.pairAnchors;
+  if (!members || members.version !== 2 || !Array.isArray(members.members)) return null;
+  if (!pair || pair.version !== 2 || !pair.driver || !Array.isArray(pair.workers)) return null;
+  if (pair.workers.length !== normalized.workerIds.length || members.members.length !== group.members.length) return null;
+  if (members.members.length !== pair.workers.length + 1 || !sameAnchor(members.members[0], pair.driver)) return null;
+  for (var i = 0; i < pair.workers.length; i++) {
+    if (!sameAnchor(members.members[i + 1], pair.workers[i])) return null;
+  }
+  return { driver: pair.driver, workers: pair.workers };
+}
+
+// Returns null when no safe repair applies, { drop: true } when the stored
+// Driver or every Worker was deleted, or { changed: true } after reducing the
+// record to its exact surviving Driver and Workers. An absent anchor is
+// evidence of deletion only when every session record was read; after any
+// unreadable or unparseable record the stored group is preserved unchanged.
+function repairDeletedMembers(group, normalized, sessions, options) {
+  if (typeof group.id !== "string" || !group.id || !normalized.ok || normalized.kind !== "versioned") return null;
+  var agreed = agreedAnchors(group, normalized);
+  if (!agreed) return null;
+  var ownerId = group.ownerId || null;
+  var driver = classify(sessions, agreed.driver);
+  var workers = agreed.workers.map(function (anchor) { return classify(sessions, anchor); });
+  var all = [driver].concat(workers);
+  var absent = 0;
+  var seen = [];
+  for (var i = 0; i < all.length; i++) {
+    if (all[i].state === "absent") { absent++; continue; }
+    if (all[i].state !== "exact") return null;
+    if ((all[i].session.ownerId || null) !== ownerId || seen.indexOf(all[i].session) !== -1) return null;
+    seen.push(all[i].session);
+  }
+  if (absent === 0 || (options && options.loadUncertain)) return null;
+  var survivors = [];
+  var survivorAnchors = [];
+  for (var j = 0; j < workers.length; j++) {
+    if (workers[j].state !== "exact") continue;
+    survivors.push(workers[j].session);
+    survivorAnchors.push(agreed.workers[j]);
+  }
+  if (driver.state !== "exact" || survivors.length === 0) return { drop: true };
+  var memberIds = [driver.session.localId].concat(survivors.map(function (session) { return session.localId; }));
+  var nextPair = { version: 2, driverId: driver.session.localId, workerIds: memberIds.slice(1) };
+  var checked = roles.normalizePair(nextPair, memberIds);
+  if (!checked.ok || checked.kind !== "versioned") return null;
+  group.members = memberIds;
+  group.pair = nextPair;
+  group.memberAnchors = { version: 2, members: [agreed.driver].concat(survivorAnchors) };
+  group.pairAnchors = { version: 2, driver: agreed.driver, workers: survivorAnchors };
+  return { changed: true };
+}
+
+module.exports = { repairDeletedMembers: repairDeletedMembers, classifyAnchor: classify };

package/lib/session-split-groups.js

@@ -4,6 +4,7 @@ var splitRoles = require("./session-split-group-roles");
 var versionedStore = require("./session-split-group-v2-store");
 var multiWorkerFeature = require("./multi-worker-feature");
 var groupPersistence = require("./session-split-group-persistence");
+var deletionCleanup = require("./session-split-group-cleanup");
 function truncateTitle(title) {
   var value = String(title || "New Session");
   return value.length > 20 ? value.slice(0, 19) + "…" : value;
@@ -20,7 +21,15 @@ function createSplitGroupStore(opts) {
   var stagedTransfers = [];
   var versionedEnabled = multiWorkerFeature.isEnabled(opts.multiWorkerFeature);
   var persistence = groupPersistence.attachPersistence(Object.assign({}, opts, { versionedEnabled: versionedEnabled }));
-  function save() { return persistence.save(groups); }
+  var cleanup = deletionCleanup.attachDeletionCleanup({
+    sessions: sessions, groups: function () { return groups; }, save: save,
+    broadcast: function () { broadcast(); }, onPairChanged: function (group) { onPairChanged(group); },
+    retryDelaysMs: opts.persistRetryDelaysMs, setTimer: opts.setTimer, clearTimer: opts.clearTimer, logger: opts.logger,
+  });
+  function save() {
+    persistence.save(groups);
+    cleanup.saved();
+  }
   function isMultiUser() {
     return !!(usersModule && usersModule.isMultiUser && usersModule.isMultiUser());
   }
@@ -354,33 +363,8 @@ function createSplitGroupStore(opts) {
     return { ok: true, group: removed };
   }
 
-  function dissolveBySession(localId) {
-    var index = groups.findIndex(function (group) { return group.members.indexOf(localId) !== -1; });
-    if (index === -1) return false;
-    var group = groups[index];
-    var normalized = splitRoles.normalizePair(group.pair, group.members);
-    var beforeMembers = group.members.slice();
-    var beforePair = group.pair && Object.assign({}, group.pair);
-    if (beforePair && Array.isArray(beforePair.workerIds)) beforePair.workerIds = beforePair.workerIds.slice();
-    var removed = null;
-    if (normalized.ok && normalized.kind === "versioned" && normalized.driverId !== localId &&
-        normalized.workerIds.length > 1) {
-      var remaining = normalized.workerIds.filter(function (id) { return id !== localId; });
-      group.members = [normalized.driverId].concat(remaining);
-      group.pair = { version: 2, driverId: normalized.driverId, workerIds: remaining };
-    } else {
-      removed = groups.splice(index, 1)[0];
-    }
-    try { save(); }
-    catch (error) {
-      if (removed) groups.splice(index, 0, removed);
-      else { group.members = beforeMembers; group.pair = beforePair; }
-      return false;
-    }
-    broadcast();
-    onPairChanged(group);
-    return true;
-  }
+  // Deletion cleanup is irreversible; see session-split-group-cleanup.js.
+  function dissolveBySession(localId) { return cleanup.sessionDeleted(localId); }
 
   function refreshAnchors(localId) {
     var group = groupForMember(localId);
@@ -457,6 +441,7 @@ function createSplitGroupStore(opts) {
     changed: versionedChanged,
   });
   groups = persistence.load();
+  if (persistence.loadRewriteError()) cleanup.recordFailure("startup rewrite", persistence.loadRewriteError());
   return { create: create, createOwned: createOwned, dissolveOwned: dissolveOwned,
     beginOwnedDriverTransfer: beginOwnedDriverTransfer, commitOwnedDriverTransfer: commitOwnedDriverTransfer,
     rollbackOwnedDriverTransfer: rollbackOwnedDriverTransfer,
@@ -464,6 +449,7 @@ function createSplitGroupStore(opts) {
     addWorker: versionedMutations.addWorker, replaceWorker: versionedMutations.replaceWorker,
     removeWorker: versionedMutations.removeWorker,
     refreshAutoName: refreshAutoName, refreshAnchors: refreshAnchors,
+    persistenceStatus: cleanup.status, retryPersistence: cleanup.retryNow, shutdown: cleanup.shutdown,
     listFor: listFor, groupForMember: groupForMember, get groups() { return groups; } };
 }
 
@@ -475,6 +461,7 @@ function attachSplitGroups(ctx) {
     broadcast: broadcast,
     onPairChanged: ctx.onPairChanged,
     multiWorkerFeature: ctx.multiWorkerFeature,
+    sessionLoadUncertain: ctx.sm.sessionLoadUncertain,
   });
 
   function sendState(ws) {
@@ -503,7 +490,7 @@ function attachSplitGroups(ctx) {
   ctx.sm.setOnSessionDeleted(store.dissolveBySession);
   ctx.sm.setOnSessionRenamed(store.refreshAutoName);
   ctx.sm.setOnSessionIdentityAssigned(store.refreshAnchors);
-  return { handleMessage: handleMessage, sendConnectionState: sendState, store: store };
+  return { handleMessage: handleMessage, sendConnectionState: sendState, store: store, shutdown: store.shutdown };
 }
 
 module.exports = { attachSplitGroups: attachSplitGroups, createSplitGroupStore: createSplitGroupStore, autoGroupName: autoGroupName };

package/lib/sessions.js

@@ -271,9 +271,16 @@ function createSessionManager(opts) {
     return null;
   }
 
+  // Records that could not be read or parsed may still be live sessions.
+  // Split-group recovery reads this so it never treats them as deleted.
+  var sessionLoadUncertain = false;
+
   function loadSessions() {
     var files;
-    try { files = fs.readdirSync(sessionsDir); } catch { return; }
+    try { files = fs.readdirSync(sessionsDir); } catch (e) {
+      if (!e || e.code !== "ENOENT") sessionLoadUncertain = true;
+      return;
+    }
 
     // Clean up stale temp files from interrupted atomic writes
     for (var ti = 0; ti < files.length; ti++) {
@@ -286,14 +293,14 @@ function createSessionManager(opts) {
     for (var i = 0; i < files.length; i++) {
       if (!files[i].endsWith(".jsonl")) continue;
       var content;
-      try { content = fs.readFileSync(path.join(sessionsDir, files[i]), "utf8"); } catch { continue; }
+      try { content = fs.readFileSync(path.join(sessionsDir, files[i]), "utf8"); } catch { sessionLoadUncertain = true; continue; }
       var lines = content.trim().split("\n");
       if (lines.length === 0) continue;
 
       var meta;
-      try { meta = JSON.parse(lines[0]); } catch { continue; }
-      var pendingOrigin = typeof meta.sessionOriginId === "string" && meta.sessionOriginId.trim() && meta.sessionOriginId.length <= 128;
-      if (meta.type !== "meta" || (!meta.cliSessionId && !pendingOrigin)) continue;
+      try { meta = JSON.parse(lines[0]); } catch { sessionLoadUncertain = true; continue; }
+      var pendingOrigin = meta && typeof meta.sessionOriginId === "string" && meta.sessionOriginId.trim() && meta.sessionOriginId.length <= 128;
+      if (!meta || meta.type !== "meta" || (!meta.cliSessionId && !pendingOrigin)) { sessionLoadUncertain = true; continue; }
 
       var history = [];
       for (var j = 1; j < lines.length; j++) {
@@ -632,11 +639,25 @@ function createSessionManager(opts) {
     };
   }
 
-  function mapSessionsForClient(source, clientActiveId, wsUnread) {
+  // Counted over every session, including hidden ones, so delete
+  // confirmations can state the full cascade. In multi-user mode only the
+  // Driver's own owner receives it: another viewer could otherwise infer
+  // hidden or private Workers, and a missing count means "unknown" to the
+  // client, never zero. viewerId must come from the authenticated socket.
+  function ownedWorkerCountFor(session, node, owned, viewerId) {
+    if (node.role !== "driver") return 0;
+    if (users.isMultiUser() && (!viewerId || (session.ownerId || null) !== viewerId)) return undefined;
+    return owned[session.localId] ? owned[session.localId].length : 0;
+  }
+
+  function mapSessionsForClient(source, clientActiveId, wsUnread, viewerId) {
     var hierarchy = sessionProvenance.hierarchyFor(source);
+    var owned = sessionProvenance.ownedWorkersByDriver([...sessions.values()]);
     return source.map(function (session) {
       var mapped = mapSessionForClient(session, clientActiveId, wsUnread);
       var node = hierarchy[session.localId];
+      var ownedCount = ownedWorkerCountFor(session, node, owned, viewerId);
+      if (ownedCount !== undefined) mapped.ownedWorkerCount = ownedCount;
       mapped.sessionRole = node.role;
       mapped.parentSessionId = node.parentSessionId;
       mapped.parentAvailable = node.parentAvailable;
@@ -667,7 +688,7 @@ function createSessionManager(opts) {
         if (ws.readyState === 1) {
           ws.send(JSON.stringify({
             type: "session_list",
-            sessions: mapSessionsForClient(filtered, clientActiveId, wsUnread),
+            sessions: mapSessionsForClient(filtered, clientActiveId, wsUnread, ws._clayUser ? ws._clayUser.id : null),
           }));
         }
       });
@@ -1389,6 +1410,7 @@ function createSessionManager(opts) {
     set codexWebSearch(v) { codexWebSearch = v; },
     sessions: sessions,
     sessionsDir: sessionsDir,
+    sessionLoadUncertain: function () { return sessionLoadUncertain; },
     setOnSessionDeleted: function (fn) { onSessionDeleted = fn || function () {}; },
     addOnSessionDeleted: function (fn) { if (typeof fn === "function") sessionDeletedListeners.push(fn); },
     addOnSessionViewed: function (fn) { if (typeof fn === "function") sessionViewedListeners.push(fn); },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.3.1-beta.2",
+  "version": "4.3.1-beta.3",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"