clay-server 5.1.0 → 5.2.0-beta.1

package/lib/public/modules/app-messages.js

@@ -1483,6 +1483,10 @@ export function processMessage(msg) {
         addContextOverflowMessage(msg);
         break;
 
+      case "account_auth_required":
+        window.location.reload();
+        break;
+
       case "auth_required":
         removeMatePreThinking();
         setActivity(null);

package/lib/public/modules/passkey-browser.js

@@ -0,0 +1,69 @@
+function decode(value) {
+  var base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+  return Uint8Array.from(atob(base64), function (character) { return character.charCodeAt(0); });
+}
+function encode(value) {
+  var bytes = new Uint8Array(value); var binary = '';
+  bytes.forEach(function (byte) { binary += String.fromCharCode(byte); });
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+function serialize(credential) {
+  if (!credential) throw new Error('No passkey was selected.');
+  var response = { clientDataJSON: encode(credential.response.clientDataJSON) };
+  ['attestationObject', 'authenticatorData', 'signature', 'userHandle'].forEach(function (key) {
+    if (credential.response[key]) response[key] = encode(credential.response[key]);
+  });
+  if (credential.response.getTransports) response.transports = credential.response.getTransports();
+  return { id: credential.id, rawId: encode(credential.rawId), type: credential.type, response: response,
+    clientExtensionResults: credential.getClientExtensionResults(), authenticatorAttachment: credential.authenticatorAttachment };
+}
+function prepare(options) {
+  var publicKey = Object.assign({}, options, { challenge: decode(options.challenge) });
+  ['allowCredentials', 'excludeCredentials'].forEach(function (field) {
+    if (options[field]) publicKey[field] = options[field].map(function (key) { return Object.assign({}, key, { id: decode(key.id) }); });
+  });
+  if (options.user) publicKey.user = Object.assign({}, options.user, { id: decode(options.user.id) });
+  return publicKey;
+}
+export function supported() { return !!(window.isSecureContext && window.PublicKeyCredential && navigator.credentials); }
+export function passkeyError(error) {
+  if (error.name === 'NotAllowedError' || error.name === 'AbortError') return 'Passkey request cancelled or timed out. You can try again or use your password.';
+  if (error.name === 'InvalidStateError') return 'This passkey is already registered. Choose a different device or passkey.';
+  return error.message || 'Could not use this passkey.';
+}
+export async function createPasskey(options) {
+  if (!supported()) throw new Error('Passkeys need a supported browser and a secure connection.');
+  return serialize(await navigator.credentials.create({ publicKey: prepare(options) }));
+}
+export async function getPasskey(options) {
+  if (!supported()) throw new Error('Passkeys need a supported browser and a secure connection.');
+  return serialize(await navigator.credentials.get({ publicKey: prepare(options) }));
+}
+export async function request(url, data) {
+  var response = await fetch(url, data === undefined ? { credentials: 'same-origin' } : {
+    method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data),
+  });
+  var result = await response.json();
+  if (!response.ok) throw new Error(result.error || 'Could not complete this request.');
+  return result;
+}
+export async function initPasskeyLogin() {
+  var button = document.getElementById('passkey-login');
+  if (!button || !supported()) return;
+  try {
+    var status = await request('/auth/passkeys/status');
+    if (status.origin !== location.origin || document.getElementById('mode-row').hidden) return;
+    button.hidden = false;
+    button.onclick = async function () {
+      button.disabled = true;
+      var error = document.getElementById('error'); error.textContent = '';
+      try {
+        var options = await request('/auth/passkeys/login/options', {});
+        var response = await getPasskey(options.options);
+        await request('/auth/passkeys/login/verify', { response: response });
+        location.href = '/';
+      } catch (failure) { error.textContent = passkeyError(failure); }
+      finally { button.disabled = false; }
+    };
+  } catch (failure) { /* Password sign-in remains available when passkeys cannot load. */ }
+}

package/lib/public/modules/passkey-server-settings.js

@@ -0,0 +1,57 @@
+import { store } from './store.js';
+import { setSettingsDraft, clearSettingsDraft } from './server-settings-state.js';
+
+function render(state) {
+  var section = document.getElementById('passkey-policy');
+  if (!section) return;
+  section.hidden = !state.available;
+  var input = section.querySelector('[name=origin]');
+  if (state.draft === undefined) input.value = state.origin || '';
+  input.disabled = !!state.pending || !!state.locked;
+  section.querySelector('[name=currentPassword]').disabled = !!state.pending;
+  section.querySelector('button').disabled = !!state.pending || !!state.locked;
+  section.querySelector('[data-passkey-editor]').hidden = !!state.locked;
+  section.querySelector('[role=status]').textContent = state.error || (state.pending ? 'Saving…' : state.origin ?
+    'Passkeys are available at ' + state.origin + (state.locked ? '. Remove registered passkeys before changing this address.' : '.') : 'Not configured. Password sign-in remains available.');
+}
+export async function loadPasskeyServerSettings() {
+  if (!document.getElementById('passkey-policy') || (store.get('passkeyPolicy') || {}).draft !== undefined) return;
+  try {
+    var response = await fetch('/api/passkey-policy'); var data = await response.json();
+    if (!response.ok) throw new Error(data.error || 'Could not load passkey settings.');
+    store.set({ passkeyPolicy: data }); render(data);
+  } catch (error) {
+    var state = Object.assign({}, store.get('passkeyPolicy'), { error: error.message });
+    store.set({ passkeyPolicy: state }); render(state);
+  }
+}
+export function initPasskeyServerSettings() {
+  var anchor = document.getElementById('account-auth-policy');
+  if (!anchor || document.getElementById('passkey-policy')) return;
+  var section = document.createElement('section'); section.id = 'passkey-policy'; section.className = 'settings-card'; section.hidden = true;
+  section.innerHTML = '<h3>Passkey sign-in address</h3><p class="settings-hint">Configure the shared server address for passkey sign-in. Users register and manage their own passkeys in Personal settings → Account. Passwords remain available.</p>' +
+    '<form><label class="settings-label" for="passkey-origin">Sign-in address</label><input class="us-text-input" id="passkey-origin" name="origin" type="url" placeholder="https://clay.example.com" required>' +
+    '<p class="settings-hint">Use the permanent HTTPS address for this server. Local development can use http://localhost with its port.</p>' +
+    '<div data-passkey-editor><label class="settings-label" for="passkey-admin-password">Administrator password</label><input class="us-text-input" id="passkey-admin-password" name="currentPassword" type="password" autocomplete="current-password" required>' +
+    '<div class="settings-form-actions"><button class="settings-btn-sm" type="submit">Save passkey address</button></div></div></form><p class="settings-hint" role="status"></p>';
+  anchor.after(section);
+  var input = section.querySelector('[name=origin]');
+  input.oninput = function () {
+    var state = Object.assign({}, store.get('passkeyPolicy'), { draft: input.value, error: '' });
+    if (input.value === (state.origin || '')) { delete state.draft; clearSettingsDraft('passkeys'); }
+    else setSettingsDraft('passkeys', true);
+    store.set({ passkeyPolicy: state }); render(state);
+  };
+  section.querySelector('form').onsubmit = async function (event) {
+    event.preventDefault();
+    var state = Object.assign({}, store.get('passkeyPolicy'), { pending: true, error: '' });
+    store.set({ passkeyPolicy: state }); render(state);
+    var password = section.querySelector('[name=currentPassword]');
+    try {
+      var response = await fetch('/api/passkey-policy', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ origin: input.value, currentPassword: password.value }) });
+      var data = await response.json(); if (!response.ok) throw new Error(data.error || 'Could not save passkey settings.');
+      state = data; clearSettingsDraft('passkeys');
+    } catch (error) { state.pending = false; state.error = error.message; }
+    finally { password.value = ''; store.set({ passkeyPolicy: state }); render(state); }
+  };
+}

package/lib/public/modules/project-logs-render.js

@@ -366,11 +366,12 @@ export function renderDetail(detailEl, entry, handlers) {
     formatTime(entry.updatedAt || entry.createdAt),
   ].filter(Boolean).join(" · ");
   setText(header, ".project-log-byline", byline);
-  if (handlers && handlers.canDelete && !entry.scheduledResult) {
+  if (handlers && handlers.canDelete && !entry.scheduledResult && !entry.deleted) {
     var deleteButton = document.createElement("button");
     deleteButton.type = "button";
     deleteButton.className = "project-log-delete-button";
-    deleteButton.innerHTML = '<i data-lucide="trash-2"></i><span>Delete log</span>';
+    deleteButton.innerHTML = '<i data-lucide="trash-2"></i><span></span>';
+    deleteButton.querySelector("span").textContent = handlers.deleteLabel || "Delete log";
     deleteButton.addEventListener("click", function () { handlers.onDelete(entry); });
     header.appendChild(deleteButton);
   }

package/lib/public/modules/server-settings-controls.js

@@ -10,6 +10,7 @@ function status(id, text) {
 }
 
 function sendSetting(type, values, buttonId, statusId) {
+  if (type === 'set_pin' && store.get('serverPinAvailable') !== true) return;
   var ws = getWs();
   if (!ws || ws.readyState !== 1) { status(statusId, 'Disconnected. Your change has not been saved.'); return; }
   var button = document.getElementById(buttonId);
@@ -29,6 +30,15 @@ function sendSetting(type, values, buttonId, statusId) {
   }, 12000);
 }
 
+export function setServerPinAvailability(available) {
+  store.set({ serverPinAvailable: !!available });
+  var section = document.getElementById('settings-server-pin');
+  if (!section) return;
+  section.hidden = !available;
+  section.querySelectorAll('input,button').forEach(function (element) { element.disabled = !available; });
+  if (!available) hidePinForm();
+}
+
 export function handleServerSettingResult(msg) {
   var type = msg.type.replace(/_result$/, '');
   var pending = Object.assign({}, store.get('serverSettingsPending') || {});

package/lib/public/modules/server-settings.js

@@ -1,4 +1,5 @@
 import { initStorageUsage, loadStorageUsage } from './server-storage-settings.js';
+import { initAccountAuthSettings, loadAccountAuthSettings } from './account-auth-settings.js';
 // Full-app server administration shell. Page state survives navigation and closing.
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
@@ -7,7 +8,7 @@ import { closeFileViewer } from './filebrowser.js';
 import { checkAdminAccess, loadAdminSection } from './admin.js';
 import { openUserSettings } from './user-settings.js';
 import { initNetworkSettings, loadNetworkSettings } from './server-network-settings.js';
-import { initServerControls } from './server-settings-controls.js';
+import { initServerControls, setServerPinAvailability } from './server-settings-controls.js';
 import { initServerEnvironment, loadSharedEnv } from './server-settings-environment.js';
 import { renderSettingsNavigation } from './server-settings-navigation.js';
 import { hasSettingsDrafts, confirmSettingsAction, trapSettingsFocus } from './server-settings-state.js';
@@ -41,6 +42,7 @@ function selectPage(id, focus) {
   });
   document.getElementById('settings-nav-dropdown').value = id;
   if (id === 'network') loadNetworkSettings();
+  if (id === 'security') loadAccountAuthSettings();
   if (id === 'storage') loadStorageUsage();
   if (id === 'environment') loadSharedEnv();
   if (id.indexOf('admin-') === 0) {
@@ -64,6 +66,8 @@ async function openSettings() {
   var status = document.getElementById('settings-access-status');
   status.textContent = 'Checking administrator access…';
   store.set({ serverSettingsAuthorized: false });
+  var serverPinSection = document.getElementById('settings-server-pin');
+  if (serverPinSection) serverPinSection.hidden = true;
   root().querySelectorAll('.server-settings-section').forEach(function (page) { page.classList.remove('active'); });
   try {
     var response = await fetch('/api/me', { credentials: 'same-origin' });
@@ -78,6 +82,7 @@ async function openSettings() {
     await checkAdminAccess();
     if (!isSettingsOpen()) return;
     store.set({ serverSettingsAuthorized: true });
+    setServerPinAvailability(!data.multiUser);
     status.textContent = '';
     renderSettingsNavigation(!!data.multiUser, selectPage);
     selectPage(store.get('serverSettingsPage') || 'overview', false);
@@ -111,7 +116,7 @@ function closeSettings() {
 
 export function initServerSettings() {
   if (!root()) return;
-  initNetworkSettings(); initServerControls(); initServerEnvironment(); initStorageUsage();
+  initNetworkSettings(); initServerControls(); initServerEnvironment(); initStorageUsage(); initAccountAuthSettings();
   document.getElementById('server-settings-btn').addEventListener('click', openSettings);
   document.getElementById('server-settings-close').onclick = closeSettings;
   document.getElementById('settings-personal-link').onclick = function () {

package/lib/public/modules/user-settings-account.js

@@ -1,4 +1,5 @@
 import { refreshIcons } from './icons.js';
+import { resetAccountSessions } from './user-settings-sessions.js';
 import { confirmSettingsAction as showConfirmDialog } from './server-settings-state.js';
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
@@ -10,6 +11,7 @@ import { syncCapsulePreference } from './capsule-preference.js';
 import { getEmailAccountListCache } from './context-sources.js';
 function applyProjectMateDmsClass(enabled) { document.body.classList.toggle('project-mate-dms-disabled', !enabled); }
 export function showPinForm() {
+  if (store.get('userPasswordEnabled')) { window.location.href = '/account/password'; return; }
   var pinForm = document.getElementById('us-pin-form');
   if (!pinForm) return;
   if(!pinForm.classList.contains('hidden'))return;
@@ -76,6 +78,7 @@ export function hidePinForm(force) {
 // --- Account population ---
 
 export function populateAccount() {
+  resetAccountSessions();
   fetch('/api/profile').then(function (r) {
     if (!r.ok) return null;
     return r.json();
@@ -98,9 +101,19 @@ export function populateAccount() {
       if (data.role) parts.push(data.role.charAt(0).toUpperCase() + data.role.slice(1));
       accountSubline.textContent = parts.length ? parts.join(' · ') : 'Local profile';
     }
-    store.set({userPinEnabled:!!data.pinEnabled});
+    store.set({userPinEnabled:!!data.pinEnabled, userPasswordEnabled:!!data.passwordEnabled});
+    var passkeyRow = document.getElementById('us-passkey-row');
+    if (passkeyRow) passkeyRow.hidden = !data.passwordEnabled;
+    var sessionsRow = document.getElementById('us-sessions-row');
+    if (sessionsRow) sessionsRow.hidden = !data.passwordEnabled && !data.pinEnabled;
     if (pinSetBtnEl) {
       pinSetBtnEl.textContent = store.get('userPinEnabled') ? 'Change PIN' : 'Set PIN';
+      if (data.passwordEnabled) pinSetBtnEl.textContent = 'Change password';
+      var row = pinSetBtnEl.closest('.settings-field-row');
+      if (row) {
+        row.querySelector('.settings-label').textContent = data.passwordEnabled ? 'Password' : 'Account PIN';
+        row.querySelector('.settings-hint').textContent = data.passwordEnabled ? 'Change your account password or passphrase.' : 'Manage your account PIN.';
+      }
     }
     if (pinFormTitle) {
       pinFormTitle.textContent = store.get('userPinEnabled') ? 'Change PIN' : 'Set PIN';

package/lib/public/modules/user-settings-sessions.js

@@ -0,0 +1,120 @@
+import { store } from './store.js';
+
+function describe(value) {
+  if (!value || value === 'Earlier session') return 'Unknown device';
+  var browser = /Edg(?:e|A|iOS)?\//.test(value) ? 'Edge' : /Firefox\/|FxiOS\//.test(value) ? 'Firefox' : /Chrome\/|CriOS\//.test(value) ? 'Chrome' : /Safari\//.test(value) ? 'Safari' : 'Browser';
+  var system = /Android/.test(value) ? 'Android' : /iPhone|iPad/.test(value) ? 'iOS' : /Windows/.test(value) ? 'Windows' : /Macintosh/.test(value) ? 'macOS' : /Linux/.test(value) ? 'Linux' : '';
+  return browser + (system ? ' on ' + system : '');
+}
+function state() { return store.get('accountSessionsPanel') || { epoch: 0, open: false, entries: [] }; }
+function update(values) { store.set({ accountSessionsPanel: Object.assign({}, state(), values) }); render(); }
+function render() {
+  var panel = document.getElementById('us-sessions-panel'); if (!panel) return;
+  var scroll = []; var ancestor = panel.parentElement;
+  while (ancestor) { scroll.push({ element: ancestor, top: ancestor.scrollTop }); ancestor = ancestor.parentElement; }
+  var current = state(); var toggle = document.getElementById('us-sessions-toggle');
+  panel.hidden = !current.open; toggle.setAttribute('aria-expanded', String(!!current.open));
+  toggle.textContent = current.open ? 'Hide sessions' : 'Manage sessions'; toggle.disabled = !!current.saving;
+  var list = panel.querySelector('[data-list]'); list.replaceChildren();
+  var previousGroup = panel.querySelector('[data-earlier]'); if (previousGroup) previousGroup.remove();
+  var unknown = current.entries.filter(function (entry) { return entry.unknownDevice && !entry.current; });
+  var older = document.createElement('details'); older.dataset.earlier = ''; var summary = document.createElement('summary');
+  summary.className = 'settings-label'; summary.textContent = 'Earlier sessions without device details (' + unknown.length + ')'; older.append(summary);
+  var explanation = document.createElement('p'); explanation.className = 'settings-hint';
+  explanation.textContent = 'These sessions predate device tracking. Their browser and previous activity are unknown; matching labels do not mean they are the same device.';
+  older.append(explanation); older.open = !!current.showEarlier;
+  older.ontoggle = function () { if (older.isConnected) store.set({ accountSessionsPanel: Object.assign({}, state(), { showEarlier: older.open }) }); };
+  var olderList = document.createElement('div'); olderList.setAttribute('role', 'list'); older.append(olderList);
+  current.entries.forEach(function (entry) {
+    var row = document.createElement('div'); row.className = 'settings-field-row'; row.setAttribute('role', 'listitem');
+    var detail = document.createElement('div'); var title = document.createElement('span'); title.className = 'settings-label';
+    title.textContent = describe(entry.userAgent) + (entry.current ? ' · This session' : '');
+    var hint = document.createElement('p'); hint.className = 'settings-hint';
+    hint.textContent = entry.method + (entry.lastSeenAt ? ' · Last active ' + new Date(entry.lastSeenAt).toLocaleString() : ' · Previous activity unknown') +
+      (entry.address ? ' · Last observed IP ' + entry.address : '') +
+      (entry.expiresAt ? ' · Expires ' + new Date(entry.expiresAt).toLocaleDateString() : ' · Compatibility session');
+    detail.append(title, hint);
+    var button = document.createElement('button'); button.type = 'button'; button.className = 'settings-btn-sm'; button.textContent = 'Sign out';
+    button.dataset.sessionId = entry.id; button.setAttribute('aria-label', 'Sign out ' + describe(entry.userAgent) + (entry.current ? ' current session' : ''));
+    button.disabled = !!current.pending;
+    button.onclick = function () { choose(entry.id); };
+    if (current.target === entry.id) {
+      var confirmation = document.createElement('div'); confirmation.className = 'us-session-row-confirm';
+      confirmation.setAttribute('role', 'group'); confirmation.setAttribute('aria-label', 'Confirm session sign-out');
+      var question = document.createElement('p'); question.className = 'settings-hint';
+      question.textContent = entry.current ? 'Sign out this browser? You will need to sign in again.' : 'Sign out this session?';
+      var actions = document.createElement('div'); actions.className = 'settings-form-actions';
+      var confirm = document.createElement('button'); confirm.type = 'button'; confirm.className = 'settings-btn-sm settings-btn-danger';
+      confirm.dataset.rowConfirm = ''; confirm.textContent = current.saving ? 'Signing out…' : 'Sign out'; confirm.disabled = !!current.pending;
+      confirm.onclick = function () { request(entry.id); };
+      var cancel = document.createElement('button'); cancel.type = 'button'; cancel.className = 'settings-btn-sm';
+      cancel.dataset.rowCancel = ''; cancel.textContent = 'Cancel'; cancel.disabled = !!current.pending;
+      cancel.onclick = function () { update({ target: null, error: '' }); restoreFocus(entry.id); };
+      actions.append(confirm, cancel); confirmation.append(question, actions);
+      if (current.error) { var error = document.createElement('p'); error.className = 'settings-status'; error.setAttribute('role', 'alert'); error.textContent = current.error; confirmation.append(error); }
+      row.append(detail, confirmation);
+    } else row.append(detail, button);
+    (entry.unknownDevice && !entry.current ? olderList : list).append(row);
+  });
+  if (unknown.length) list.after(older);
+  panel.querySelector('[data-status]').textContent = current.target && current.target !== 'others' ? '' : current.error || (current.pending ? current.saving ? 'Signing out…' : 'Loading sessions…' : current.message || '');
+  panel.querySelector('[data-retry]').hidden = !current.error || !!current.target;
+  panel.querySelector('[data-others]').disabled = !!current.pending || !current.entries.some(function (entry) { return !entry.current; });
+  panel.querySelector('[data-confirmation]').hidden = current.target !== 'others';
+  var selected = current.entries.find(function (entry) { return entry.id === current.target; });
+  panel.querySelector('[data-question]').textContent = selected && selected.current ? 'Sign out this browser? Your settings will close and you will need to sign in again.' : 'Sign out the selected sessions? Their open connections will close.';
+  panel.querySelector('[data-confirm]').disabled = !!current.pending;
+  panel.querySelector('[data-cancel]').disabled = !!current.pending;
+  scroll.forEach(function (position) { position.element.scrollTop = position.top; });
+}
+function choose(id) {
+  update({ target: id, error: '', message: '' });
+  document.querySelector(id === 'others' ? '#us-sessions-panel [data-confirm]' : '#us-sessions-panel [data-row-confirm]').focus({ preventScroll: true });
+}
+function restoreFocus(id) {
+  var panel = document.getElementById('us-sessions-panel');
+  var button = Array.from(panel.querySelectorAll('[data-session-id]')).find(function (item) { return item.dataset.sessionId === id; });
+  (button || (id === 'others' ? panel.querySelector('[data-others]') : document.getElementById('us-sessions-toggle'))).focus({ preventScroll: true });
+}
+async function request(id) {
+  var entries = state().entries; var index = entries.findIndex(function (entry) { return entry.id === id; });
+  var neighbor = entries[index + 1] || entries[index - 1];
+  var epoch = state().epoch + 1;
+  update({ epoch: epoch, pending: true, saving: !!id, error: '', message: '' });
+  try {
+    var response = await fetch('/api/account-sessions', id ? { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ id: id }) } : {});
+    var data = await response.json();
+    if (epoch !== state().epoch) return;
+    if (!response.ok) {
+      if (response.status === 401 || response.status === 403) update({ entries: [], target: null });
+      throw new Error(data.error || 'Could not manage sessions.');
+    }
+    if (data.signedOut) { window.location.href = '/'; return; }
+    update({ entries: data.sessions, target: null, pending: false, saving: false, message: id ? 'Selected sessions signed out.' : '' });
+    if (id) restoreFocus(id === 'others' ? id : neighbor && neighbor.id);
+  } catch (error) {
+    if (epoch === state().epoch) update({ pending: false, saving: false, error: error.message });
+    var retry = document.querySelector('#us-sessions-panel [data-row-confirm]');
+    if (epoch === state().epoch && id && retry) retry.focus({ preventScroll: true });
+  }
+}
+export function resetAccountSessions() {
+  update({ epoch: state().epoch + 1, open: false, entries: [], target: null, pending: false, saving: false, error: '', message: '', showEarlier: false });
+}
+export function initAccountSessions() {
+  var toggle = document.getElementById('us-sessions-toggle'); if (!toggle || document.getElementById('us-sessions-panel')) return;
+  var panel = document.createElement('div'); panel.id = 'us-sessions-panel'; panel.hidden = true;
+  panel.innerHTML = '<p class="settings-hint">Each entry represents a browser session. Account sessions expire after 30 days, or after 7 days without use.</p>' +
+    '<div data-list role="list" aria-label="Signed-in sessions"></div><div class="settings-form-actions"><button type="button" class="settings-btn-sm" data-others>Sign out other sessions</button></div>' +
+    '<div data-confirmation role="group" aria-label="Confirm sign-out" hidden><p class="settings-hint" data-question></p><div class="settings-form-actions"><button type="button" class="settings-btn-sm settings-btn-danger" data-confirm>Sign out</button><button type="button" class="settings-btn-sm" data-cancel>Cancel</button></div></div>' +
+    '<p class="settings-status" role="status" data-status></p><button type="button" class="settings-btn-sm" data-retry hidden>Retry</button>';
+  toggle.closest('.settings-field-row').after(panel);
+  toggle.onclick = function () {
+    if (state().open) { resetAccountSessions(); toggle.focus(); }
+    else { update({ open: true }); request(); }
+  };
+  panel.querySelector('[data-others]').onclick = function () { choose('others'); };
+  panel.querySelector('[data-retry]').onclick = function () { request(); };
+  panel.querySelector('[data-confirm]').onclick = function () { request(state().target); };
+  panel.querySelector('[data-cancel]').onclick = function () { var id = state().target; update({ target: null, error: '' }); restoreFocus(id); };
+}

package/lib/public/modules/user-settings.js

@@ -1,4 +1,5 @@
 import { initPersonalAppearance } from './user-settings-appearance.js';
+import { initAccountSessions, resetAccountSessions } from './user-settings-sessions.js';
 import { initPersonalVoice } from './user-settings-voice.js';
 import { isolateSettingsDialog } from './server-settings-state.js';
 import { initPersonalProfile } from './user-settings-profile.js';
@@ -29,6 +30,7 @@ var pinCancelBtn = null;
 
 export function initUserSettings() {
   buildUserSettingsLayout();
+  initAccountSessions();
   settingsEl = document.getElementById('user-settings');
   openBtn = document.getElementById('user-settings-btn');
   closeBtn = document.getElementById('user-settings-close');
@@ -204,6 +206,7 @@ export function openUserSettings(initialSection) {
 
 export function closeUserSettings() {
   guardUserSettingsLeave(function () {
+    resetAccountSessions();
     finishUserSettingsExtras();
     settingsEl.classList.add('hidden');
     var restore=store.get('userSettingsRestore');if(restore)restore();store.set({userSettingsRestore:null});

package/lib/public/modules/you-activity.js

@@ -7,6 +7,7 @@ function state() { return store.get('youActivity') || {}; }
 function put(values) { store.set({ youActivity: Object.assign({}, state(), values) }); }
 function el(id) { return document.getElementById(id); }
 function describe(item) {
+  if (item.action === 'delete') return 'You deleted a memory from Me.';
   if (item.action === 'archive') return 'Clay stopped using a memory about you.';
   return (item.action === 'update' ? 'Clay updated: ' : 'Clay remembered: ') + (item.summary || item.title);
 }
@@ -67,7 +68,7 @@ function render() {
     var text = document.createElement('span'); text.textContent = describe(item);
     var time = document.createElement('small'); time.textContent = relativeTime(item.at);
     button.append(text, time);
-    button.addEventListener('click', function () { close(); openYou(item.action === 'archive' ? null : item.ref); });
+    button.addEventListener('click', function () { close(); openYou(item.action === 'archive' || item.action === 'delete' ? null : item.ref); });
     list.appendChild(button);
   });
   el('you-activity-more').classList.toggle('hidden', state().nextOffset == null);
@@ -76,6 +77,7 @@ export function handleYouActivity(msg) {
   if (!el('you-activity') || (msg.activity && msg.activity.seen)) return;
   if (msg.type === 'you_reviewed') { put({ error: '' }); render(); return; }
   if (msg.type === 'you_changed') {
+    if (msg.activity && msg.activity.deleted) { request(); return; }
     if (msg.activity && msg.activity.error) { put({ error: msg.activity.error }); announce(msg.activity.error); return; }
     put({ error: '' });
     if (msg.activity && msg.activity.id && (state().seen || []).indexOf(msg.activity.id) === -1) {

package/lib/public/modules/you.js

@@ -5,6 +5,8 @@ import { refreshIcons } from './icons.js';
 import { renderList, renderDetail, categoryLabel } from './project-logs-render.js';
 import { registerRightWorkbench, claimRightWorkbench, releaseRightWorkbench } from './right-workbench.js';
 
+var deleteDialog = null;
+var deleteDialogFocus = null;
 function state() { return store.get('you') || {}; }
 function put(values) { store.set({ you: Object.assign({}, state(), values) }); }
 function element(id) { return document.getElementById(id); }
@@ -70,6 +72,37 @@ function requestEntry(ref) {
   put({ readId: sendYou('you_read', { ref: ref }), selected: ref, scroll: element('you-list').scrollTop });
   status(state().readId ? 'Loading…' : 'Reconnect to read this memory.');
 }
+function closeDeleteDialog(force) {
+  if (!deleteDialog) return;
+  if (!force && state().deleteId) return;
+  deleteDialog.classList.add('hidden');
+  put({ deleteId: null, deleteEntry: null });
+  if (deleteDialogFocus && deleteDialogFocus.isConnected) deleteDialogFocus.focus();
+  deleteDialogFocus = null;
+}
+function sendDelete() {
+  var entry = state().deleteEntry;
+  if (!entry || state().deleteId) return;
+  var requestId = sendYou('you_delete', { ref: entry.ref, expectedRevision: entry.revisions });
+  put({ deleteId: requestId });
+  var confirm = deleteDialog.querySelector('[data-action="delete"]');
+  var cancel = deleteDialog.querySelector('[data-action="cancel"]');
+  confirm.disabled = true; cancel.disabled = true;
+  deleteDialog.querySelector('.you-delete-dialog-status').textContent = requestId ? 'Deleting memory… Stored audit history remains.' : 'Reconnect to delete this memory.';
+  if (requestId) { deleteDialog.tabIndex = -1; deleteDialog.focus(); }
+  if (!requestId) { put({ deleteId: null }); confirm.disabled = false; cancel.disabled = false; }
+}
+function deleteEntry(entry) {
+  if (!entry || state().deleteId || !deleteDialog) return;
+  put({ deleteEntry: entry });
+  deleteDialogFocus = document.activeElement;
+  deleteDialog.querySelector('.you-delete-dialog-title').textContent = entry.title || 'Untitled memory';
+  deleteDialog.querySelector('.you-delete-dialog-status').textContent = '';
+  deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+  deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+  deleteDialog.classList.remove('hidden');
+  deleteDialog.querySelector('[data-action="cancel"]').focus();
+}
 function windowState(wide, fullscreen) {
   put({ wide: wide, fullscreen: fullscreen });
   element('you-panel').classList.toggle('project-logs-wide', wide && !fullscreen);
@@ -117,6 +150,25 @@ function ensurePanel() {
     '<div id="you-list" class="project-logs-list" role="list"></div><main id="you-detail" class="project-logs-detail hidden"></main>' +
     '<button id="you-more" type="button" class="you-more hidden">Load more</button>';
   document.getElementById('main-panels').appendChild(panel);
+  var dialog = document.createElement('div');
+  dialog.className = 'project-log-delete-dialog you-delete-dialog hidden';
+  dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true'); dialog.setAttribute('aria-labelledby', 'you-delete-heading'); dialog.tabIndex = -1;
+  dialog.innerHTML = '<div class="project-log-delete-dialog-card"><h2 id="you-delete-heading">Delete this memory?</h2><p>This removes the memory from Me immediately. Clay’s audit history will retain that it was deleted.</p><p class="project-log-delete-dialog-title you-delete-dialog-title"></p><p class="project-log-delete-dialog-status you-delete-dialog-status" role="status"></p><div class="project-log-delete-dialog-actions"><button type="button" data-action="cancel">Cancel</button><button type="button" class="danger" data-action="delete">Delete memory</button></div></div>';
+  panel.appendChild(dialog); deleteDialog = dialog;
+  dialog.querySelector('[data-action="cancel"]').addEventListener('click', function () { closeDeleteDialog(false); });
+  dialog.querySelector('[data-action="delete"]').addEventListener('click', sendDelete);
+  dialog.addEventListener('keydown', function (event) {
+    event.stopPropagation();
+    if (event.key === 'Escape') { event.preventDefault(); closeDeleteDialog(false); return; }
+    if (event.key === 'Tab') {
+      var buttons = Array.from(dialog.querySelectorAll('button:not(:disabled)'));
+      if (!buttons.length) { event.preventDefault(); dialog.focus(); return; }
+      var first = buttons[0]; var last = buttons[buttons.length - 1];
+      if (event.shiftKey && document.activeElement === first) { event.preventDefault(); last.focus(); }
+      else if (!event.shiftKey && document.activeElement === last) { event.preventDefault(); first.focus(); }
+    }
+  });
+  dialog.addEventListener('click', function (event) { if (event.target === dialog) closeDeleteDialog(false); });
   element('you-close').addEventListener('click', closeYou);
   element('you-back').addEventListener('click', showList);
   element('you-wide').addEventListener('click', function () { windowState(!state().wide, false); });
@@ -159,6 +211,7 @@ export function openYou(ref) {
   if (ref) element('you-close').focus(); else element('you-search').focus();
 }
 export function closeYou() {
+  closeDeleteDialog(true);
   releaseRightWorkbench('you');
   if (!state().open) return;
   element('you-panel').classList.add('hidden');
@@ -172,6 +225,17 @@ export function closeYou() {
 export function handleYouMessage(msg) {
   if (msg.type === 'you_reviewed') { if (state().open) { requestList(); if (state().selected) requestEntry(state().selected); } return; }
   if (msg.type === 'you_changed') {
+    if (msg.activity && msg.activity.deleted) {
+      requestAttention();
+      if (state().selected === msg.activity.ref) {
+        if (state().deleteEntry && state().deleteEntry.ref === msg.activity.ref) closeDeleteDialog(true);
+        put({ readId: null, renderedRef: null, renderedRevision: null });
+        showList();
+        element('you-search').focus();
+        status('This memory was deleted and is no longer available.');
+      } else if (state().open) requestList();
+      return;
+    }
     requestAttention();
     if (msg.activity && msg.activity.seen) { if (state().open && !state().selected) requestList(); return; }
     if (msg.activity && msg.activity.error) { status(msg.activity.error); return; }
@@ -179,7 +243,7 @@ export function handleYouMessage(msg) {
     return;
   }
   var s = state();
-  var key = { you_attention: 'attentionId', you_seen: 'seenId', you_list: 'listId', you_read: 'readId', you_comment: 'commentId', you_retry: 'retryId' }[msg.operation];
+  var key = { you_attention: 'attentionId', you_seen: 'seenId', you_list: 'listId', you_read: 'readId', you_comment: 'commentId', you_retry: 'retryId', you_delete: 'deleteId' }[msg.operation];
   if (!key || !s[key] || s[key] !== msg.requestId) return;
   var cleared = {}; cleared[key] = null; put(cleared);
   if (msg.operation === 'you_comment' && element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
@@ -189,10 +253,25 @@ export function handleYouMessage(msg) {
     return;
   }
   if (!state().open && msg.operation === 'you_read') return;
-  if (!msg.ok) { if (msg.operation === 'you_read') showList(); status(msg.error || 'Clay could not complete this request.'); return; }
+  if (!msg.ok) {
+    if (msg.operation === 'you_read') showList();
+    if (msg.operation === 'you_delete' && deleteDialog) {
+      deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+      deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+      deleteDialog.querySelector('.you-delete-dialog-status').textContent = msg.error || 'The memory could not be deleted. Try again.';
+    }
+    status(msg.error || 'Clay could not complete this request.'); return;
+  }
   status('');
   var result = msg.result;
-  if (msg.operation === 'you_list') {
+  if (msg.operation === 'you_delete') {
+    closeDeleteDialog(true);
+    put({ deleteEntry: null });
+    showList();
+    element('you-search').focus();
+    requestAttention();
+    status('Memory deleted. Stored audit history remains.');
+  } else if (msg.operation === 'you_list') {
     var entries = s.append ? (s.entries || []).concat(result.items) : result.items;
     put({ entries: entries, nextOffset: result.nextOffset });
     var emptyMessage = state().query || state().category
@@ -210,7 +289,7 @@ export function handleYouMessage(msg) {
     element('you-detail').classList.remove('hidden'); element('you-back').classList.remove('hidden');
     var previousInput = element('you-comment-input');
     var draft = previousInput && previousInput.dataset.ref === result.ref ? previousInput.value : '';
-    renderDetail(element('you-detail'), result, { commentPrefix: 'you', commentReviewer: 'Clay', onComment: function (ref, body, feedback, input) {
+    renderDetail(element('you-detail'), result, { commentPrefix: 'you', commentReviewer: 'Clay', canDelete: !result.deleted, deleteLabel: 'Delete memory', onDelete: deleteEntry, onComment: function (ref, body, feedback, input) {
       if (state().commentId) return;
       put({ commentId: sendYou('you_comment', { ref: ref, body: body }), commentRef: ref });
       input.form.querySelector('button').disabled = !!state().commentId;
@@ -236,13 +315,19 @@ export function initYou() {
   element('you-button').addEventListener('click', function () { openYou(); });
   store.subscribe(function (next, previous) {
     if (next.currentSlug !== previous.currentSlug || next.myUserId !== previous.myUserId) {
-      closeYou(); clearTimeout(state().searchTimer);
+      closeDeleteDialog(true); closeYou(); clearTimeout(state().searchTimer);
       if (next.myUserId !== previous.myUserId) { if (element('you-panel')) element('you-panel').remove(); put({ entries: [], query: '', category: '', attentionVersion: 0, acknowledged: null, attentionId: null, seenId: null }); showAttention({ unread: 0, version: 0 }); }
-      put({ listId: null, readId: null, commentId: null, retryId: null, seenId: null });
+      put({ listId: null, readId: null, commentId: null, retryId: null, seenId: null, deleteId: null, deleteEntry: null });
       if (element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
     }
     if (previous.connected && !next.connected) {
       put({ commentId: null, seenId: null, attentionId: null });
+      if (state().deleteId && deleteDialog) {
+        put({ deleteId: null });
+        deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+        deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+        deleteDialog.querySelector('.you-delete-dialog-status').textContent = 'Disconnected. Reconnect before deleting. Stored audit history remains.';
+      }
       if (element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
       if (state().open) status('Disconnected. Reconnect before sending or refreshing.');
     }

package/lib/public/style.css

@@ -47,6 +47,7 @@
 @import url("css/stt.css");
 @import url("css/profile.css");
 @import url("css/user-settings.css?v=20260828-type1");
+@import url("css/user-settings-sessions.css");
 @import url("css/settings-ui.css");
 @import url("css/admin.css");
 @import url("css/session-search.css");