clay-server 5.1.1-beta.1 → 5.2.0-beta.10

package/lib/public/modules/user-settings-sessions.js

@@ -0,0 +1,120 @@
+import { store } from './store.js';
+
+function describe(value) {
+  if (!value || value === 'Earlier session') return 'Unknown device';
+  var browser = /Edg(?:e|A|iOS)?\//.test(value) ? 'Edge' : /Firefox\/|FxiOS\//.test(value) ? 'Firefox' : /Chrome\/|CriOS\//.test(value) ? 'Chrome' : /Safari\//.test(value) ? 'Safari' : 'Browser';
+  var system = /Android/.test(value) ? 'Android' : /iPhone|iPad/.test(value) ? 'iOS' : /Windows/.test(value) ? 'Windows' : /Macintosh/.test(value) ? 'macOS' : /Linux/.test(value) ? 'Linux' : '';
+  return browser + (system ? ' on ' + system : '');
+}
+function state() { return store.get('accountSessionsPanel') || { epoch: 0, open: false, entries: [] }; }
+function update(values) { store.set({ accountSessionsPanel: Object.assign({}, state(), values) }); render(); }
+function render() {
+  var panel = document.getElementById('us-sessions-panel'); if (!panel) return;
+  var scroll = []; var ancestor = panel.parentElement;
+  while (ancestor) { scroll.push({ element: ancestor, top: ancestor.scrollTop }); ancestor = ancestor.parentElement; }
+  var current = state(); var toggle = document.getElementById('us-sessions-toggle');
+  panel.hidden = !current.open; toggle.setAttribute('aria-expanded', String(!!current.open));
+  toggle.textContent = current.open ? 'Hide sessions' : 'Manage sessions'; toggle.disabled = !!current.saving;
+  var list = panel.querySelector('[data-list]'); list.replaceChildren();
+  var previousGroup = panel.querySelector('[data-earlier]'); if (previousGroup) previousGroup.remove();
+  var unknown = current.entries.filter(function (entry) { return entry.unknownDevice && !entry.current; });
+  var older = document.createElement('details'); older.dataset.earlier = ''; var summary = document.createElement('summary');
+  summary.className = 'settings-label'; summary.textContent = 'Earlier sessions without device details (' + unknown.length + ')'; older.append(summary);
+  var explanation = document.createElement('p'); explanation.className = 'settings-hint';
+  explanation.textContent = 'These sessions predate device tracking. Their browser and previous activity are unknown; matching labels do not mean they are the same device.';
+  older.append(explanation); older.open = !!current.showEarlier;
+  older.ontoggle = function () { if (older.isConnected) store.set({ accountSessionsPanel: Object.assign({}, state(), { showEarlier: older.open }) }); };
+  var olderList = document.createElement('div'); olderList.setAttribute('role', 'list'); older.append(olderList);
+  current.entries.forEach(function (entry) {
+    var row = document.createElement('div'); row.className = 'settings-field-row'; row.setAttribute('role', 'listitem');
+    var detail = document.createElement('div'); var title = document.createElement('span'); title.className = 'settings-label';
+    title.textContent = describe(entry.userAgent) + (entry.current ? ' · This session' : '');
+    var hint = document.createElement('p'); hint.className = 'settings-hint';
+    hint.textContent = entry.method + (entry.lastSeenAt ? ' · Last active ' + new Date(entry.lastSeenAt).toLocaleString() : ' · Previous activity unknown') +
+      (entry.address ? ' · Last observed IP ' + entry.address : '') +
+      (entry.expiresAt ? ' · Expires ' + new Date(entry.expiresAt).toLocaleDateString() : ' · Compatibility session');
+    detail.append(title, hint);
+    var button = document.createElement('button'); button.type = 'button'; button.className = 'settings-btn-sm'; button.textContent = 'Sign out';
+    button.dataset.sessionId = entry.id; button.setAttribute('aria-label', 'Sign out ' + describe(entry.userAgent) + (entry.current ? ' current session' : ''));
+    button.disabled = !!current.pending;
+    button.onclick = function () { choose(entry.id); };
+    if (current.target === entry.id) {
+      var confirmation = document.createElement('div'); confirmation.className = 'us-session-row-confirm';
+      confirmation.setAttribute('role', 'group'); confirmation.setAttribute('aria-label', 'Confirm session sign-out');
+      var question = document.createElement('p'); question.className = 'settings-hint';
+      question.textContent = entry.current ? 'Sign out this browser? You will need to sign in again.' : 'Sign out this session?';
+      var actions = document.createElement('div'); actions.className = 'settings-form-actions';
+      var confirm = document.createElement('button'); confirm.type = 'button'; confirm.className = 'settings-btn-sm settings-btn-danger';
+      confirm.dataset.rowConfirm = ''; confirm.textContent = current.saving ? 'Signing out…' : 'Sign out'; confirm.disabled = !!current.pending;
+      confirm.onclick = function () { request(entry.id); };
+      var cancel = document.createElement('button'); cancel.type = 'button'; cancel.className = 'settings-btn-sm';
+      cancel.dataset.rowCancel = ''; cancel.textContent = 'Cancel'; cancel.disabled = !!current.pending;
+      cancel.onclick = function () { update({ target: null, error: '' }); restoreFocus(entry.id); };
+      actions.append(confirm, cancel); confirmation.append(question, actions);
+      if (current.error) { var error = document.createElement('p'); error.className = 'settings-status'; error.setAttribute('role', 'alert'); error.textContent = current.error; confirmation.append(error); }
+      row.append(detail, confirmation);
+    } else row.append(detail, button);
+    (entry.unknownDevice && !entry.current ? olderList : list).append(row);
+  });
+  if (unknown.length) list.after(older);
+  panel.querySelector('[data-status]').textContent = current.target && current.target !== 'others' ? '' : current.error || (current.pending ? current.saving ? 'Signing out…' : 'Loading sessions…' : current.message || '');
+  panel.querySelector('[data-retry]').hidden = !current.error || !!current.target;
+  panel.querySelector('[data-others]').disabled = !!current.pending || !current.entries.some(function (entry) { return !entry.current; });
+  panel.querySelector('[data-confirmation]').hidden = current.target !== 'others';
+  var selected = current.entries.find(function (entry) { return entry.id === current.target; });
+  panel.querySelector('[data-question]').textContent = selected && selected.current ? 'Sign out this browser? Your settings will close and you will need to sign in again.' : 'Sign out the selected sessions? Their open connections will close.';
+  panel.querySelector('[data-confirm]').disabled = !!current.pending;
+  panel.querySelector('[data-cancel]').disabled = !!current.pending;
+  scroll.forEach(function (position) { position.element.scrollTop = position.top; });
+}
+function choose(id) {
+  update({ target: id, error: '', message: '' });
+  document.querySelector(id === 'others' ? '#us-sessions-panel [data-confirm]' : '#us-sessions-panel [data-row-confirm]').focus({ preventScroll: true });
+}
+function restoreFocus(id) {
+  var panel = document.getElementById('us-sessions-panel');
+  var button = Array.from(panel.querySelectorAll('[data-session-id]')).find(function (item) { return item.dataset.sessionId === id; });
+  (button || (id === 'others' ? panel.querySelector('[data-others]') : document.getElementById('us-sessions-toggle'))).focus({ preventScroll: true });
+}
+async function request(id) {
+  var entries = state().entries; var index = entries.findIndex(function (entry) { return entry.id === id; });
+  var neighbor = entries[index + 1] || entries[index - 1];
+  var epoch = state().epoch + 1;
+  update({ epoch: epoch, pending: true, saving: !!id, error: '', message: '' });
+  try {
+    var response = await fetch('/api/account-sessions', id ? { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ id: id }) } : {});
+    var data = await response.json();
+    if (epoch !== state().epoch) return;
+    if (!response.ok) {
+      if (response.status === 401 || response.status === 403) update({ entries: [], target: null });
+      throw new Error(data.error || 'Could not manage sessions.');
+    }
+    if (data.signedOut) { window.location.href = '/'; return; }
+    update({ entries: data.sessions, target: null, pending: false, saving: false, message: id ? 'Selected sessions signed out.' : '' });
+    if (id) restoreFocus(id === 'others' ? id : neighbor && neighbor.id);
+  } catch (error) {
+    if (epoch === state().epoch) update({ pending: false, saving: false, error: error.message });
+    var retry = document.querySelector('#us-sessions-panel [data-row-confirm]');
+    if (epoch === state().epoch && id && retry) retry.focus({ preventScroll: true });
+  }
+}
+export function resetAccountSessions() {
+  update({ epoch: state().epoch + 1, open: false, entries: [], target: null, pending: false, saving: false, error: '', message: '', showEarlier: false });
+}
+export function initAccountSessions() {
+  var toggle = document.getElementById('us-sessions-toggle'); if (!toggle || document.getElementById('us-sessions-panel')) return;
+  var panel = document.createElement('div'); panel.id = 'us-sessions-panel'; panel.hidden = true;
+  panel.innerHTML = '<p class="settings-hint">Each entry represents a browser session. Account sessions expire after 30 days, or after 7 days without use.</p>' +
+    '<div data-list role="list" aria-label="Signed-in sessions"></div><div class="settings-form-actions"><button type="button" class="settings-btn-sm" data-others>Sign out other sessions</button></div>' +
+    '<div data-confirmation role="group" aria-label="Confirm sign-out" hidden><p class="settings-hint" data-question></p><div class="settings-form-actions"><button type="button" class="settings-btn-sm settings-btn-danger" data-confirm>Sign out</button><button type="button" class="settings-btn-sm" data-cancel>Cancel</button></div></div>' +
+    '<p class="settings-status" role="status" data-status></p><button type="button" class="settings-btn-sm" data-retry hidden>Retry</button>';
+  toggle.closest('.settings-field-row').after(panel);
+  toggle.onclick = function () {
+    if (state().open) { resetAccountSessions(); toggle.focus(); }
+    else { update({ open: true }); request(); }
+  };
+  panel.querySelector('[data-others]').onclick = function () { choose('others'); };
+  panel.querySelector('[data-retry]').onclick = function () { request(); };
+  panel.querySelector('[data-confirm]').onclick = function () { request(state().target); };
+  panel.querySelector('[data-cancel]').onclick = function () { var id = state().target; update({ target: null, error: '' }); restoreFocus(id); };
+}

package/lib/public/modules/user-settings.js

@@ -1,4 +1,5 @@
 import { initPersonalAppearance } from './user-settings-appearance.js';
+import { initAccountSessions, resetAccountSessions } from './user-settings-sessions.js';
 import { initPersonalVoice } from './user-settings-voice.js';
 import { isolateSettingsDialog } from './server-settings-state.js';
 import { initPersonalProfile } from './user-settings-profile.js';
@@ -29,6 +30,7 @@ var pinCancelBtn = null;
 
 export function initUserSettings() {
   buildUserSettingsLayout();
+  initAccountSessions();
   settingsEl = document.getElementById('user-settings');
   openBtn = document.getElementById('user-settings-btn');
   closeBtn = document.getElementById('user-settings-close');
@@ -73,7 +75,7 @@ export function initUserSettings() {
   for (var i = 0; i < navItems.length; i++) {
     navItems[i].addEventListener('click', function () {
       var section = this.dataset.section;
-      guardUserSettingsLeave(function () { switchSection(section); });
+      guardUserSettingsLeave(function () { switchSection(section); }, section);
     });
   }
 
@@ -81,7 +83,8 @@ export function initUserSettings() {
   var navDropdown = document.getElementById('user-settings-nav-dropdown');
   if (navDropdown) {
     navDropdown.addEventListener('change', function () {
-      var value = this.value; guardUserSettingsLeave(function () {switchSection(value);});
+      var value = this.value; guardUserSettingsLeave(function () {switchSection(value);}, value);
+      this.value = settingsEl.querySelector('.us-section.active').dataset.section;
     });
   }
 
@@ -204,6 +207,7 @@ export function openUserSettings(initialSection) {
 
 export function closeUserSettings() {
   guardUserSettingsLeave(function () {
+    resetAccountSessions();
     finishUserSettingsExtras();
     settingsEl.classList.add('hidden');
     var restore=store.get('userSettingsRestore');if(restore)restore();store.set({userSettingsRestore:null});

package/lib/public/modules/vendor-login-browser.js

@@ -1,3 +1,4 @@
+import { escapeHtml } from './utils.js';
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
 import { iconHtml, refreshIcons } from './icons.js';
@@ -33,7 +34,8 @@ export function openLoginBrowser(msg) {
   }
   closeLoginBrowser();
   var isMcp = msg.kind === 'mcp';
-  var title = isMcp ? 'Sign in to ' + (msg.label || 'MCP server') : (msg.vendor === "codex" ? "Sign in to Codex" : "Sign in to Claude");
+  var provider = (store.get('vendorInfo') || {})[msg.vendor] || {};
+  var title = 'Sign in to ' + (isMcp ? msg.label || 'MCP server' : provider.displayName || msg.vendor || 'Provider');
   store.set({ vendorLoginBrowser: {
     browserId: msg.browserId, vendor: msg.vendor, kind: msg.kind, connectionId: msg.connectionId, slug: msg.slug || store.get('currentSlug'),
     previousFocus: document.activeElement, decoding: false, pointerY: null, pointerId: null, mouseDown: false, moveTimer: null, pendingMove: null, resizeObserver: null, requestedSize: null, phase: "loading",
@@ -43,7 +45,7 @@ export function openLoginBrowser(msg) {
   dialog.className = "login-browser";
   dialog.setAttribute("aria-labelledby", "login-browser-title");
   dialog.innerHTML = '<header class="login-browser-header">' +
-    '<img class="login-browser-vendor" src="/' + (msg.vendor === "codex" ? 'codex-avatar.png' : 'claude-code-avatar.png') + '" alt="">' +
+    '<img class="login-browser-vendor" src="' + escapeHtml(provider.avatar || '') + '" alt="">' +
     '<div class="login-browser-heading"><h2 id="login-browser-title"></h2>' +
     '<span class="login-browser-origin">Opening sign-in page…</span></div>' +
     '<div class="login-browser-actions">' +
@@ -56,7 +58,7 @@ export function openLoginBrowser(msg) {
     '<div class="login-browser-loading"><span class="login-browser-spinner" aria-hidden="true"></span><strong>Opening your sign-in page</strong><span>This may take a moment.</span></div>' +
     '<textarea class="login-browser-keyboard" aria-label="Type into the remote sign-in page" autocomplete="off" autocapitalize="off" spellcheck="false"></textarea></div>' +
     '<footer class="login-browser-footer"><div class="login-browser-info"><div class="login-browser-status"><span class="login-browser-status-dot" aria-hidden="true"></span><p role="status">Preparing sign-in…</p></div>' +
-    '<p class="login-browser-privacy">Browser cookies are discarded when this session ends. You stay signed in to ' + (msg.vendor === "codex" ? 'Codex' : 'Claude') + ' after this browser closes.</p></div>' +
+    '<p class="login-browser-privacy">Browser cookies are discarded when this session ends. You stay signed in to ' + escapeHtml(provider.displayName || msg.vendor || 'the provider') + ' after this browser closes.</p></div>' +
     '<button type="button" data-action="terminal" class="login-browser-terminal">' + iconHtml("terminal") + '<span>Use terminal sign-in</span>' + iconHtml("arrow-up-right") + '</button></footer>';
   dialog.querySelector("h2").textContent = title;
   document.body.appendChild(dialog);

package/lib/public/modules/vendor-login.js

@@ -31,7 +31,7 @@ function vendorDisplayName(vendor) {
   var vendors = store.get('vendorInfo') || {};
   var info = vendors[vendor];
   if (info && info.displayName) return info.displayName;
-  return vendor === "codex" ? "Codex" : "Claude Code";
+  return vendor || "Provider";
 }
 
 function currentProjectSlug() {
@@ -170,7 +170,7 @@ export function requestVendorLogin(vendor, opts) {
     vendor: target,
     auto: !!options.auto,
     sessionId: options.sessionId || store.get('activeSessionId') || null,
-    mode: options.mode || ((target === "claude" || target === "codex") ? "browser" : "terminal"),
+    mode: options.mode || ((((store.get("vendorInfo") || {})[target] || {}).browserLoginSupported === true) ? "browser" : "terminal"),
   }));
   showLoginStartedBanner(target);
   return true;

package/lib/public/modules/vendor-priority.js

@@ -1,4 +1,18 @@
-export var VENDOR_ORDER = ["claude", "codex", "grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode", "kiro"];
+export var VENDOR_ORDER = ["claude", "codex", "muse", "grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode", "kiro"];
+
+// Availability comes from the caller's server catalog. Unknown providers keep
+// their catalog order within each availability group.
+export function sortVendorEntries(entries) {
+  return entries.map(function (entry, index) { return { entry: entry, index: index }; }).sort(function (a, b) {
+    var installed = Number(!!b.entry.installed) - Number(!!a.entry.installed);
+    if (installed) return installed;
+    var aRank = VENDOR_ORDER.indexOf(a.entry.id);
+    var bRank = VENDOR_ORDER.indexOf(b.entry.id);
+    if (aRank === -1) aRank = VENDOR_ORDER.length;
+    if (bRank === -1) bRank = VENDOR_ORDER.length;
+    return aRank - bRank || a.index - b.index;
+  }).map(function (item) { return item.entry; });
+}
 export var EXPERIMENTAL_VENDORS = ["grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode"];
 
 export function isExperimentalVendor(vendor) {

package/lib/public/modules/wireframe-workbench.js

@@ -1,3 +1,4 @@
+import { forwardStudioPresentation, registerStudioPaint } from './clay-studio-render.js';
 import { sketchBrand, sketchCredit } from './wireframe-style.js';
 import { store } from './store.js';
 import { claimRightWorkbench, registerRightWorkbench, releaseRightWorkbench } from './right-workbench.js';
@@ -80,7 +81,7 @@ function createPanel() {
 export function openWireframe(message) {
   if (!message || typeof message.source !== 'string' || new TextEncoder().encode(message.source).length > 100000) return;
   if (store.get('paneMode') && window.parent !== window) {
-    window.parent.postMessage({ type: 'clay-pane-present-wireframe', message: message, projectSlug: store.get('currentSlug'), sessionId: store.get('activeSessionId') }, window.location.origin);
+    forwardStudioPresentation(message, 'clay-pane-present-wireframe');
     return;
   }
   claimRightWorkbench('wireframe');
@@ -92,7 +93,8 @@ export function openWireframe(message) {
   el.querySelector('header strong').textContent = draft.title;
   el.querySelector('.wireframe-save-status').textContent = '';
   el.querySelector('form').hidden = true;
-  draw(draft, el).catch(function () {});
+  var painted = draw(draft, el); registerStudioPaint(Object.assign({}, message, { source: draft.source }), el.querySelector("header"), painted, el.querySelector(".wireframe-workbench-canvas"));
+  painted.catch(function () {});
 }
 function draw(draft, el) {
   var canvas = el.querySelector('.wireframe-workbench-canvas');
@@ -104,6 +106,7 @@ function draw(draft, el) {
     var image = wireframeImage(svg, draft.title);
     canvas.replaceChildren(image);
     mountWireframeViewport(canvas, image, el.querySelector('.wireframe-zoom'));
+    return image.decode ? image.decode() : undefined;
   }).catch(function (error) {
     if (store.get('wireframeDraft') !== active) throw error;
     status.textContent = error.name === 'AbortError' ? 'Rendering was interrupted. Reopen the wireframe to retry.' : error.message;

package/lib/public/modules/you-activity.js

@@ -7,6 +7,7 @@ function state() { return store.get('youActivity') || {}; }
 function put(values) { store.set({ youActivity: Object.assign({}, state(), values) }); }
 function el(id) { return document.getElementById(id); }
 function describe(item) {
+  if (item.action === 'delete') return 'You deleted a memory from Me.';
   if (item.action === 'archive') return 'Clay stopped using a memory about you.';
   return (item.action === 'update' ? 'Clay updated: ' : 'Clay remembered: ') + (item.summary || item.title);
 }
@@ -67,7 +68,7 @@ function render() {
     var text = document.createElement('span'); text.textContent = describe(item);
     var time = document.createElement('small'); time.textContent = relativeTime(item.at);
     button.append(text, time);
-    button.addEventListener('click', function () { close(); openYou(item.action === 'archive' ? null : item.ref); });
+    button.addEventListener('click', function () { close(); openYou(item.action === 'archive' || item.action === 'delete' ? null : item.ref); });
     list.appendChild(button);
   });
   el('you-activity-more').classList.toggle('hidden', state().nextOffset == null);
@@ -76,6 +77,7 @@ export function handleYouActivity(msg) {
   if (!el('you-activity') || (msg.activity && msg.activity.seen)) return;
   if (msg.type === 'you_reviewed') { put({ error: '' }); render(); return; }
   if (msg.type === 'you_changed') {
+    if (msg.activity && msg.activity.deleted) { request(); return; }
     if (msg.activity && msg.activity.error) { put({ error: msg.activity.error }); announce(msg.activity.error); return; }
     put({ error: '' });
     if (msg.activity && msg.activity.id && (state().seen || []).indexOf(msg.activity.id) === -1) {

package/lib/public/modules/you.js

@@ -5,6 +5,8 @@ import { refreshIcons } from './icons.js';
 import { renderList, renderDetail, categoryLabel } from './project-logs-render.js';
 import { registerRightWorkbench, claimRightWorkbench, releaseRightWorkbench } from './right-workbench.js';
 
+var deleteDialog = null;
+var deleteDialogFocus = null;
 function state() { return store.get('you') || {}; }
 function put(values) { store.set({ you: Object.assign({}, state(), values) }); }
 function element(id) { return document.getElementById(id); }
@@ -70,6 +72,37 @@ function requestEntry(ref) {
   put({ readId: sendYou('you_read', { ref: ref }), selected: ref, scroll: element('you-list').scrollTop });
   status(state().readId ? 'Loading…' : 'Reconnect to read this memory.');
 }
+function closeDeleteDialog(force) {
+  if (!deleteDialog) return;
+  if (!force && state().deleteId) return;
+  deleteDialog.classList.add('hidden');
+  put({ deleteId: null, deleteEntry: null });
+  if (deleteDialogFocus && deleteDialogFocus.isConnected) deleteDialogFocus.focus();
+  deleteDialogFocus = null;
+}
+function sendDelete() {
+  var entry = state().deleteEntry;
+  if (!entry || state().deleteId) return;
+  var requestId = sendYou('you_delete', { ref: entry.ref, expectedRevision: entry.revisions });
+  put({ deleteId: requestId });
+  var confirm = deleteDialog.querySelector('[data-action="delete"]');
+  var cancel = deleteDialog.querySelector('[data-action="cancel"]');
+  confirm.disabled = true; cancel.disabled = true;
+  deleteDialog.querySelector('.you-delete-dialog-status').textContent = requestId ? 'Deleting memory… Stored audit history remains.' : 'Reconnect to delete this memory.';
+  if (requestId) { deleteDialog.tabIndex = -1; deleteDialog.focus(); }
+  if (!requestId) { put({ deleteId: null }); confirm.disabled = false; cancel.disabled = false; }
+}
+function deleteEntry(entry) {
+  if (!entry || state().deleteId || !deleteDialog) return;
+  put({ deleteEntry: entry });
+  deleteDialogFocus = document.activeElement;
+  deleteDialog.querySelector('.you-delete-dialog-title').textContent = entry.title || 'Untitled memory';
+  deleteDialog.querySelector('.you-delete-dialog-status').textContent = '';
+  deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+  deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+  deleteDialog.classList.remove('hidden');
+  deleteDialog.querySelector('[data-action="cancel"]').focus();
+}
 function windowState(wide, fullscreen) {
   put({ wide: wide, fullscreen: fullscreen });
   element('you-panel').classList.toggle('project-logs-wide', wide && !fullscreen);
@@ -117,6 +150,25 @@ function ensurePanel() {
     '<div id="you-list" class="project-logs-list" role="list"></div><main id="you-detail" class="project-logs-detail hidden"></main>' +
     '<button id="you-more" type="button" class="you-more hidden">Load more</button>';
   document.getElementById('main-panels').appendChild(panel);
+  var dialog = document.createElement('div');
+  dialog.className = 'project-log-delete-dialog you-delete-dialog hidden';
+  dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true'); dialog.setAttribute('aria-labelledby', 'you-delete-heading'); dialog.tabIndex = -1;
+  dialog.innerHTML = '<div class="project-log-delete-dialog-card"><h2 id="you-delete-heading">Delete this memory?</h2><p>This removes the memory from Me immediately. Clay’s audit history will retain that it was deleted.</p><p class="project-log-delete-dialog-title you-delete-dialog-title"></p><p class="project-log-delete-dialog-status you-delete-dialog-status" role="status"></p><div class="project-log-delete-dialog-actions"><button type="button" data-action="cancel">Cancel</button><button type="button" class="danger" data-action="delete">Delete memory</button></div></div>';
+  panel.appendChild(dialog); deleteDialog = dialog;
+  dialog.querySelector('[data-action="cancel"]').addEventListener('click', function () { closeDeleteDialog(false); });
+  dialog.querySelector('[data-action="delete"]').addEventListener('click', sendDelete);
+  dialog.addEventListener('keydown', function (event) {
+    event.stopPropagation();
+    if (event.key === 'Escape') { event.preventDefault(); closeDeleteDialog(false); return; }
+    if (event.key === 'Tab') {
+      var buttons = Array.from(dialog.querySelectorAll('button:not(:disabled)'));
+      if (!buttons.length) { event.preventDefault(); dialog.focus(); return; }
+      var first = buttons[0]; var last = buttons[buttons.length - 1];
+      if (event.shiftKey && document.activeElement === first) { event.preventDefault(); last.focus(); }
+      else if (!event.shiftKey && document.activeElement === last) { event.preventDefault(); first.focus(); }
+    }
+  });
+  dialog.addEventListener('click', function (event) { if (event.target === dialog) closeDeleteDialog(false); });
   element('you-close').addEventListener('click', closeYou);
   element('you-back').addEventListener('click', showList);
   element('you-wide').addEventListener('click', function () { windowState(!state().wide, false); });
@@ -159,6 +211,7 @@ export function openYou(ref) {
   if (ref) element('you-close').focus(); else element('you-search').focus();
 }
 export function closeYou() {
+  closeDeleteDialog(true);
   releaseRightWorkbench('you');
   if (!state().open) return;
   element('you-panel').classList.add('hidden');
@@ -172,6 +225,17 @@ export function closeYou() {
 export function handleYouMessage(msg) {
   if (msg.type === 'you_reviewed') { if (state().open) { requestList(); if (state().selected) requestEntry(state().selected); } return; }
   if (msg.type === 'you_changed') {
+    if (msg.activity && msg.activity.deleted) {
+      requestAttention();
+      if (state().selected === msg.activity.ref) {
+        if (state().deleteEntry && state().deleteEntry.ref === msg.activity.ref) closeDeleteDialog(true);
+        put({ readId: null, renderedRef: null, renderedRevision: null });
+        showList();
+        element('you-search').focus();
+        status('This memory was deleted and is no longer available.');
+      } else if (state().open) requestList();
+      return;
+    }
     requestAttention();
     if (msg.activity && msg.activity.seen) { if (state().open && !state().selected) requestList(); return; }
     if (msg.activity && msg.activity.error) { status(msg.activity.error); return; }
@@ -179,7 +243,7 @@ export function handleYouMessage(msg) {
     return;
   }
   var s = state();
-  var key = { you_attention: 'attentionId', you_seen: 'seenId', you_list: 'listId', you_read: 'readId', you_comment: 'commentId', you_retry: 'retryId' }[msg.operation];
+  var key = { you_attention: 'attentionId', you_seen: 'seenId', you_list: 'listId', you_read: 'readId', you_comment: 'commentId', you_retry: 'retryId', you_delete: 'deleteId' }[msg.operation];
   if (!key || !s[key] || s[key] !== msg.requestId) return;
   var cleared = {}; cleared[key] = null; put(cleared);
   if (msg.operation === 'you_comment' && element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
@@ -189,10 +253,25 @@ export function handleYouMessage(msg) {
     return;
   }
   if (!state().open && msg.operation === 'you_read') return;
-  if (!msg.ok) { if (msg.operation === 'you_read') showList(); status(msg.error || 'Clay could not complete this request.'); return; }
+  if (!msg.ok) {
+    if (msg.operation === 'you_read') showList();
+    if (msg.operation === 'you_delete' && deleteDialog) {
+      deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+      deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+      deleteDialog.querySelector('.you-delete-dialog-status').textContent = msg.error || 'The memory could not be deleted. Try again.';
+    }
+    status(msg.error || 'Clay could not complete this request.'); return;
+  }
   status('');
   var result = msg.result;
-  if (msg.operation === 'you_list') {
+  if (msg.operation === 'you_delete') {
+    closeDeleteDialog(true);
+    put({ deleteEntry: null });
+    showList();
+    element('you-search').focus();
+    requestAttention();
+    status('Memory deleted. Stored audit history remains.');
+  } else if (msg.operation === 'you_list') {
     var entries = s.append ? (s.entries || []).concat(result.items) : result.items;
     put({ entries: entries, nextOffset: result.nextOffset });
     var emptyMessage = state().query || state().category
@@ -210,7 +289,7 @@ export function handleYouMessage(msg) {
     element('you-detail').classList.remove('hidden'); element('you-back').classList.remove('hidden');
     var previousInput = element('you-comment-input');
     var draft = previousInput && previousInput.dataset.ref === result.ref ? previousInput.value : '';
-    renderDetail(element('you-detail'), result, { commentPrefix: 'you', commentReviewer: 'Clay', onComment: function (ref, body, feedback, input) {
+    renderDetail(element('you-detail'), result, { commentPrefix: 'you', commentReviewer: 'Clay', canDelete: !result.deleted, deleteLabel: 'Delete memory', onDelete: deleteEntry, onComment: function (ref, body, feedback, input) {
       if (state().commentId) return;
       put({ commentId: sendYou('you_comment', { ref: ref, body: body }), commentRef: ref });
       input.form.querySelector('button').disabled = !!state().commentId;
@@ -236,13 +315,19 @@ export function initYou() {
   element('you-button').addEventListener('click', function () { openYou(); });
   store.subscribe(function (next, previous) {
     if (next.currentSlug !== previous.currentSlug || next.myUserId !== previous.myUserId) {
-      closeYou(); clearTimeout(state().searchTimer);
+      closeDeleteDialog(true); closeYou(); clearTimeout(state().searchTimer);
       if (next.myUserId !== previous.myUserId) { if (element('you-panel')) element('you-panel').remove(); put({ entries: [], query: '', category: '', attentionVersion: 0, acknowledged: null, attentionId: null, seenId: null }); showAttention({ unread: 0, version: 0 }); }
-      put({ listId: null, readId: null, commentId: null, retryId: null, seenId: null });
+      put({ listId: null, readId: null, commentId: null, retryId: null, seenId: null, deleteId: null, deleteEntry: null });
       if (element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
     }
     if (previous.connected && !next.connected) {
       put({ commentId: null, seenId: null, attentionId: null });
+      if (state().deleteId && deleteDialog) {
+        put({ deleteId: null });
+        deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+        deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+        deleteDialog.querySelector('.you-delete-dialog-status').textContent = 'Disconnected. Reconnect before deleting. Stored audit history remains.';
+      }
       if (element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
       if (state().open) status('Disconnected. Reconnect before sending or refreshing.');
     }

package/lib/public/muse-avatar.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Muse Code">
+  <rect width="64" height="64" rx="14" fill="#111827"/>
+  <path d="M14 45V19h7l11 14 10-14h8v26h-7V30L32 45 21 30v15z" fill="#f8fafc"/>
+</svg>

package/lib/public/style.css

@@ -47,6 +47,7 @@
 @import url("css/stt.css");
 @import url("css/profile.css");
 @import url("css/user-settings.css?v=20260828-type1");
+@import url("css/user-settings-sessions.css");
 @import url("css/settings-ui.css");
 @import url("css/admin.css");
 @import url("css/session-search.css");
@@ -58,6 +59,7 @@
 @import url("css/home-debate-planning.css");
 @import url("css/home-mate-creation.css");
 @import url("css/home-mate-settings.css");
+@import url("css/mate-avatar-gallery.css");
 @import url("css/home-mate-model-picker.css");
 @import url("css/project-mate-creation.css");
 @import url("css/home-debate-live.css");
@@ -86,3 +88,7 @@
 @import url("css/server-settings-system.css");
 
 @import url("css/project-settings-modal.css");
+
+@import url("css/clay-tool-activity.css");
+
+@import url("css/contextual-clay.css");

package/lib/public/sw.js

@@ -1,4 +1,4 @@
-var CACHE_NAME = "clay-offline-v4";
+var CACHE_NAME = "clay-offline-v5";
 
 self.addEventListener("install", function (event) {
   event.waitUntil(self.skipWaiting());
@@ -23,6 +23,8 @@ self.addEventListener("activate", function (event) {
 function shouldCache(request, response) {
   if (request.method !== "GET") return false;
   if (!response || !response.ok) return false;
+  var cacheControl = response.headers && response.headers.get("Cache-Control") || "";
+  if (/(^|,)\s*(private|no-store)(?:\s*=\s*[^,]*)?(?=\s*(?:,|$))/i.test(cacheControl)) return false;
   // Cache same-origin static assets and CDN resources (jsdelivr, fonts)
   var url = new URL(request.url);
   if (url.origin === self.location.origin) return true;

package/lib/safe-bash-commands.js

@@ -115,51 +115,9 @@ function isSafeBashSegment(seg) {
 // Emit the `Bash(...)` permission patterns for ~/.claude/settings.json. Each
 // standalone command gets a bare form (zero-arg) and a space-wildcard form
 // (claude 2.x prefix matching); subcommands and exact commands likewise.
-function buildClayBashAllowPatterns() {
-  var patterns = [];
-  for (var i = 0; i < STANDALONE.length; i++) {
-    patterns.push("Bash(" + STANDALONE[i] + ")");
-    patterns.push("Bash(" + STANDALONE[i] + " *)");
-  }
-  var bins = Object.keys(SUBCOMMAND);
-  for (var b = 0; b < bins.length; b++) {
-    var subs = SUBCOMMAND[bins[b]];
-    for (var s = 0; s < subs.length; s++) {
-      var base = bins[b] + " " + subs[s];
-      patterns.push("Bash(" + base + ")");
-      patterns.push("Bash(" + base + " *)");
-    }
-  }
-  for (var e = 0; e < EXACT.length; e++) {
-    patterns.push("Bash(" + EXACT[e] + ")");
-    patterns.push("Bash(" + EXACT[e] + " *)");
-  }
-  return patterns;
-}
-
-var GENERATED_SET = {};
-(function () {
-  var p = buildClayBashAllowPatterns();
-  for (var i = 0; i < p.length; i++) GENERATED_SET[p[i]] = true;
-})();
-
-// Recognize a `permissions.allow` entry that Clay owns, so the installer can
-// strip stale variants on upgrade (including shapes a previous version wrote)
-// WITHOUT clobbering user-authored patterns. Rules:
-//   - Standalone commands: own every shape of `Bash(ls ...)` (any args), since
-//     a user pattern for a command we manage is redundant with our broad one.
-//   - Subcommand binaries (git, npm, ...) and exact commands: only strip the
-//     precise patterns we generate, so a user's `Bash(git push)` survives.
-// Legacy colon shapes are handled separately by the installer.
-function isClayManagedBashPattern(p) {
-  if (typeof p !== "string") return false;
-  if (p.indexOf("Bash(") !== 0 || p.charAt(p.length - 1) !== ")") return false;
-  if (GENERATED_SET[p]) return true;
-  var inner = p.slice(5, -1).trim();
-  if (!inner) return false;
-  var word = inner.split(/[\s:]/)[0];
-  return STANDALONE_SET[word] === true;
-}
+var patternCodec = require("./yoke/claude-permission-patterns").attachPatterns({ STANDALONE: STANDALONE, SUBCOMMAND: SUBCOMMAND, EXACT: EXACT });
+function buildClayBashAllowPatterns() { return patternCodec.build(); }
+function isClayManagedBashPattern(pattern) { return patternCodec.isManaged(pattern); }
 
 module.exports = {
   STANDALONE: STANDALONE,

package/lib/scheduled-task-records.js

@@ -18,6 +18,7 @@ function createScheduledTaskRecords(ctx) {
     var runs = Array.isArray(record.runs) ? record.runs : [];
     var readiness = ctx.runtimeStatus ? ctx.runtimeStatus(record) : null;
     return {
+      createdBy: record.createdBy || null, updatedBy: record.updatedBy || null,
       id: record.id, revision: Number(record.updatedAt || 0), name: record.name || "",
       instructions: record.task || record.prompt || record.instructions || "",
       cron: record.cron || null, date: record.date || null, time: record.time || null,
@@ -49,7 +50,7 @@ function createScheduledTaskRecords(ctx) {
     return { ok: true, record: publicRecord(record) };
   }
 
-  function update(session, id, revision, patch) {
+  function update(session, id, revision, patch, actor) {
     if (typeof id !== "string" || !ID_PATTERN.test(id)) return { ok: false, error: "Scheduled task id is invalid." };
     var record = ctx.registry.getById(id);
     if (!record) return { ok: false, error: "Scheduled task not found." };
@@ -94,6 +95,7 @@ function createScheduledTaskRecords(ctx) {
     }
     try {
       var updateData = Object.assign({}, checked.value);
+      if (actor) updateData.updatedBy = actor;
       if (claimOwner) { updateData.ownerId = session.ownerId; updateData.enabled = true; }
       if (updateData.cron) {
         updateData.date = record.cron && !record.scheduleRule ? record.date || null : null;

package/lib/scheduler.js

@@ -239,6 +239,7 @@ function createLoopRegistry(opts) {
 
   function register(data) {
     var rec = {
+      createdBy: data.createdBy || null, updatedBy: data.updatedBy || null, creationFingerprint: data.creationFingerprint || null,
       id: data.id || ("loop_" + Date.now() + "_" + require("crypto").randomBytes(3).toString("hex")),
       name: data.name || "Untitled",
       task: data.task || "",
@@ -297,6 +298,7 @@ function createLoopRegistry(opts) {
     if (!rec) return null;
     var previous = Object.assign({}, rec);
 
+    if (data.updatedBy !== undefined) rec.updatedBy = data.updatedBy;
     if (data.name !== undefined) rec.name = data.name;
     if (data.cron !== undefined) rec.cron = data.cron;
     if (data.enabled !== undefined) rec.enabled = data.enabled;