clay-server 5.1.1-beta.1 → 5.2.0-beta.2

package/lib/public/modules/account-auth-settings.js

@@ -0,0 +1,71 @@
+import { store } from './store.js';
+import { enhanceSettingsSelects } from './settings-select.js';
+import { confirmSettingsAction, setSettingsDraft, clearSettingsDraft } from './server-settings-state.js';
+import { initPasskeyServerSettings, loadPasskeyServerSettings } from './passkey-server-settings.js';
+import { initAccountTransportSettings, loadAccountTransportSettings } from './account-transport-settings.js';
+
+function render(state) {
+  var section = document.getElementById('account-auth-policy');
+  if (!section) return;
+  var select = section.querySelector('select');
+  var save = section.querySelector('[data-policy-save]');
+  section.hidden = state.available === false;
+  select.value = state.draft || state.method || 'pin';
+  select.disabled = !!state.pending || state.method === 'password' || !state.method;
+  select.dispatchEvent(new Event('settings-sync'));
+  save.hidden = !state.method || state.method === select.value;
+  save.disabled = !!state.pending;
+  section.querySelector('[role=status]').textContent = state.error || (state.pending ? 'Saving…' : state.method === 'password' ? 'Password required. Existing account PINs only authorize password setup.' : 'Existing users verify their account PIN once, then set a password before continuing.');
+}
+
+export async function loadAccountAuthSettings() {
+  loadPasskeyServerSettings();
+  var section = document.getElementById('account-auth-policy');
+  if (!section) return;
+  if ((store.get('accountAuthPolicy') || {}).draft) return;
+  try {
+    var response = await fetch('/api/account-auth-policy');
+    var data = await response.json();
+    if (!response.ok) throw new Error(data.error || 'Could not load account policy.');
+    store.set({ accountAuthPolicy: data }); render(data); loadAccountTransportSettings();
+  } catch (error) {
+    var state = Object.assign({}, store.get('accountAuthPolicy'), { error: error.message });
+    store.set({ accountAuthPolicy: state }); render(state);
+  }
+}
+
+export function initAccountAuthSettings() {
+  var page = document.querySelector('.server-settings-section[data-section="security"]');
+  if (!page || document.getElementById('account-auth-policy')) return;
+  var section = document.createElement('section'); section.id = 'account-auth-policy';
+  section.className = 'settings-card';
+  section.innerHTML = '<h3>Account sign-in</h3><div class="settings-field-row"><div><label class="settings-label" for="account-auth-method">Authentication method</label><p class="settings-hint">Applies to all accounts on this server. Users manage their own credentials in Personal settings.</p></div><select class="settings-select" id="account-auth-method" disabled><option value="pin">Account PIN</option><option value="password">Password / passphrase</option></select></div><p class="settings-hint" role="status">Loading account policy…</p><div class="settings-form-actions"><button class="settings-btn-sm" data-policy-save hidden>Apply password policy</button></div>';
+  var description = page.querySelector('.settings-page-description');
+  description.textContent = 'Sign-in policies and connection security for this server. Manage your own password, passkeys and devices in Personal settings → Account.';
+  description.after(section);
+  var select = section.querySelector('select');
+  select.onchange = function () {
+    var state = Object.assign({}, store.get('accountAuthPolicy'), { draft: select.value, error: '' });
+    if (state.draft === state.method) { delete state.draft; clearSettingsDraft('accountAuth'); }
+    else setSettingsDraft('accountAuth', true);
+    store.set({ accountAuthPolicy: state }); render(state);
+  };
+  section.querySelector('[data-policy-save]').onclick = function () {
+    confirmSettingsAction('Require passwords for account users? Everyone using an account, including you, must verify their account PIN and set a password before continuing. Existing PINs remain valid for setup until each password is saved. This change does not alter solo access or the Server PIN.', 'Require passwords', async function () {
+      var state = Object.assign({}, store.get('accountAuthPolicy'), { pending: true, error: '' });
+      store.set({ accountAuthPolicy: state }); render(state);
+      try {
+        var response = await fetch('/api/account-auth-policy', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ method: 'password' }) });
+        var data = await response.json();
+        if (!response.ok || !data.ok) throw new Error(data.error || 'Could not save the policy.');
+        clearSettingsDraft('accountAuth'); window.location.reload();
+      } catch (error) {
+        state.pending = false; state.error = error.message;
+        store.set({ accountAuthPolicy: state }); render(state);
+      }
+    });
+  };
+  enhanceSettingsSelects(section);
+  initPasskeyServerSettings();
+  initAccountTransportSettings();
+}

package/lib/public/modules/account-transport-settings.js

@@ -0,0 +1,51 @@
+import { store } from './store.js';
+import { setSettingsDraft, clearSettingsDraft } from './server-settings-state.js';
+function render(state) {
+  var section = document.getElementById('account-transport'); if (!section) return;
+  section.hidden = !state.available;
+  if (!state.dirty) {
+    section.querySelector('[name=origin]').value = state.origin || '';
+    section.querySelector('[name=proxies]').value = (state.trustedProxies || []).join('\n');
+  }
+  section.querySelectorAll('input,textarea,button').forEach(function (element) { element.disabled = !!state.pending; });
+  section.querySelector('[role=status]').textContent = state.error || (state.pending ? 'Saving…' : state.origin ? 'Saved proxy HTTPS address: ' + state.origin : 'Direct HTTPS or localhost access. No proxy headers are trusted.');
+}
+export async function loadAccountTransportSettings() {
+  if ((store.get('accountTransport') || {}).dirty) return;
+  try {
+    var response = await fetch('/api/account-transport'); var data = await response.json();
+    if (!response.ok) throw new Error(data.error || 'Could not load connection settings.');
+    var state = Object.assign({}, data, { available: (store.get('accountAuthPolicy') || {}).method === 'password' });
+    store.set({ accountTransport: state }); render(state);
+  } catch (error) {
+    var state = Object.assign({}, store.get('accountTransport'), { error: error.message });
+    store.set({ accountTransport: state }); render(state);
+  }
+}
+export function initAccountTransportSettings() {
+  var anchor = document.getElementById('passkey-policy'); if (!anchor || document.getElementById('account-transport')) return;
+  var section = document.createElement('section'); section.id = 'account-transport'; section.className = 'settings-card'; section.hidden = true;
+  section.innerHTML = '<h3>HTTPS &amp; trusted proxies</h3><p class="settings-hint">Connection security for account users on this server. Account passwords require HTTPS for remote access. Localhost is available for setup and recovery.</p>' +
+    '<form><label class="settings-label" for="account-external-origin">Proxy HTTPS address</label><input class="us-text-input" id="account-external-origin" name="origin" type="url" placeholder="https://clay.example.com">' +
+    '<label class="settings-label" for="account-trusted-proxies">Trusted proxy IP addresses</label><textarea class="settings-network-origins" id="account-trusted-proxies" name="proxies" rows="2" placeholder="One exact IP address per line"></textarea>' +
+    '<p class="settings-hint">Leave empty for direct HTTPS. Each trusted proxy must overwrite X-Forwarded-Proto and X-Real-IP, prevent direct public access to the backend, and serve this HTTPS address. Forwarded host headers are ignored.</p>' +
+    '<label class="settings-label" for="account-transport-password">Administrator password</label><input class="us-text-input" id="account-transport-password" name="password" type="password" autocomplete="current-password" required>' +
+    '<div class="settings-form-actions"><button class="settings-btn-sm">Save connection settings</button></div></form><p class="settings-hint" role="status"></p>';
+  anchor.after(section);
+  section.querySelectorAll('[name=origin],[name=proxies]').forEach(function (input) { input.oninput = function () {
+    var state = Object.assign({}, store.get('accountTransport'), { dirty: true, error: '' });
+    setSettingsDraft('accountTransport', true); store.set({ accountTransport: state }); render(state);
+  }; });
+  section.querySelector('form').onsubmit = async function (event) {
+    event.preventDefault(); var password = section.querySelector('[name=password]');
+    var state = Object.assign({}, store.get('accountTransport'), { pending: true, error: '' }); store.set({ accountTransport: state }); render(state);
+    try {
+      var response = await fetch('/api/account-transport', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({
+        origin: section.querySelector('[name=origin]').value.trim(), trustedProxies: section.querySelector('[name=proxies]').value.split(/\s+/).filter(Boolean), currentPassword: password.value,
+      }) });
+      var data = await response.json(); if (!response.ok) throw new Error(data.error || 'Could not save connection settings.');
+      state = Object.assign({}, data, { available: true }); clearSettingsDraft('accountTransport');
+    } catch (error) { state.error = error.message; state.pending = false; }
+    finally { password.value = ''; store.set({ accountTransport: state }); render(state); }
+  };
+}

package/lib/public/modules/app-header.js

@@ -350,6 +350,7 @@ export function prependOlderHistory(items, meta) {
 
   // Save current rendering state
   var savedMsgEl = store.get('currentMsgEl');
+  var savedReplayingHistory = store.get('replayingHistory');
   var savedActivity = getActivityEl();
   var savedFullText = store.get('currentFullText');
   var savedTurnCounter = getTurnCounter();
@@ -359,7 +360,7 @@ export function prependOlderHistory(items, meta) {
   var savedUsage = JSON.parse(JSON.stringify(getSessionUsage()));
 
   // Reset to initial values for clean rendering
-  store.set({ currentMsgEl: null, currentFullText: "" });
+  store.set({ currentMsgEl: null, currentFullText: "", replayingHistory: true });
   setActivityEl(null);
   setTurnCounter(0);
   resetToolState();
@@ -387,7 +388,7 @@ export function prependOlderHistory(items, meta) {
   setPrependAnchor(null);
 
   // Restore saved state
-  store.set({ currentMsgEl: savedMsgEl, currentFullText: savedFullText });
+  store.set({ currentMsgEl: savedMsgEl, currentFullText: savedFullText, replayingHistory: savedReplayingHistory });
   setActivityEl(savedActivity);
   setTurnCounter(savedTurnCounter);
   restoreToolState(savedToolsState);

package/lib/public/modules/app-messages.js

@@ -40,7 +40,7 @@ import { handleHomeMateMemoryState, handleHomeMateKnowledgeState, syncHomeMateSe
 import { renderKnowledgeList, handleKnowledgeContent, handleKnowledgeMutation } from './mate-knowledge.js';
 import { handleKnowledgeWorkbenchMessage } from './mate-knowledge-workbench.js';
 import { renderMemoryList } from './mate-memory.js';
-import { handlePaletteSessionSwitch, setPaletteVersion } from './command-palette.js';
+import { handlePaletteSessionSwitch, handlePaletteHistoryDone, handlePaletteHistoryPrepended, setPaletteVersion } from './command-palette.js';
 import { handleFindInSessionResults } from './session-search.js';
 import { syncPaneTitles, maybeRestoreSplitGroup, openGroup } from './split-view.js';
 import { showPairDialog, handlePairCreated, handleSplitDelegation, showWorkerDelegationNotice, hideWorkerDelegationNotice } from './split-pair-ui.js';
@@ -224,6 +224,7 @@ export function processMessage(msg) {
       }
     }
 
+    store.set({ currentHistoryIndex: Number.isSafeInteger(msg._historyIndex) && msg._historyIndex >= 0 ? msg._historyIndex : null });
     switch (msg.type) {
       case "message_ack":
         var acknowledgedEntry = acknowledgeMessage(msg.clientMessageId);
@@ -250,6 +251,7 @@ export function processMessage(msg) {
 
       case "history_prepend":
         prependOlderHistory(msg.items, msg.meta);
+        handlePaletteHistoryPrepended();
         break;
 
       case "history_done":
@@ -311,11 +313,16 @@ export function processMessage(msg) {
         // re-pins on every height change while armed. Disarms early on
         // any real user scroll input.
         // Skip arming when we have a pending in-conversation navigate
-        // target (file-edit deeplink) — the navigate block below scrolls
-        // that element into view, and sticky-bottom would fight it.
+        // target (file-edit or Session-entry deeplink) — the navigate block
+        // below scrolls that element into view, and sticky-bottom would
+        // fight it.
         var nav = getPendingNavigate();
         var hasNavTarget = nav && (nav.toolId || nav.assistantUuid);
-        if (hasNavTarget) {
+        var sessionEntryNav = store.get('pendingSessionEntryNavigation');
+        var hasSessionEntryNav = sessionEntryNav
+          && String(sessionEntryNav.projectSlug) === String(store.get('currentSlug'))
+          && String(sessionEntryNav.sessionId) === String(store.get('activeSessionId'));
+        if (hasNavTarget || hasSessionEntryNav) {
           // Navigate block below will scrollIntoView on the target — don't
           // arm sticky-bottom or it would fight that scroll.
           scrollToBottom();
@@ -343,6 +350,7 @@ export function processMessage(msg) {
             }
           });
         }
+        requestAnimationFrame(function () { handlePaletteHistoryDone(); });
         break;
 
       case "restore_mate_dm":
@@ -1483,6 +1491,10 @@ export function processMessage(msg) {
         addContextOverflowMessage(msg);
         break;
 
+      case "account_auth_required":
+        window.location.reload();
+        break;
+
       case "auth_required":
         removeMatePreThinking();
         setActivity(null);

package/lib/public/modules/app-rendering.js

@@ -8,10 +8,10 @@ import { refreshIcons } from './icons.js';
 import { closeToolGroup } from './tools.js';
 import { sendMessage, hasSendableContent } from './input.js';
 import { getChatLayout } from './theme.js';
-import { addToMessages, scrollToBottom, forceScrollToBottom, getMsgTime, shouldGroupMessage, getTurnCounter, getActivityEl } from './chat-render-runtime.js';
+import { addToMessages, addHistoryIndex, scrollToBottom, forceScrollToBottom, getMsgTime, shouldGroupMessage, getTurnCounter, getActivityEl } from './chat-render-runtime.js';
 import { resolveProjectAssistantIdentity, applyProjectAssistantIdentity } from './project-chat-identity.js';
 export { VENDOR_ORDER, EXPERIMENTAL_VENDORS, isExperimentalVendor } from './vendor-priority.js';
-export { initRendering, addToMessages, scrollToBottom, forceScrollToBottom, getMsgTime, shouldGroupMessage, getTurnCounter, setTurnCounter, getPrependAnchor, setPrependAnchor, getActivityEl, setActivityEl, getIsUserScrolledUp, setIsUserScrolledUp, getStickyBottom, armStickyBottom, disarmStickyBottom, VENDOR_AVATARS, VENDOR_NAMES, VENDOR_HOMEPAGES } from './chat-render-runtime.js';
+export { initRendering, addToMessages, addHistoryIndex, scrollToBottom, forceScrollToBottom, getMsgTime, shouldGroupMessage, getTurnCounter, setTurnCounter, getPrependAnchor, setPrependAnchor, getActivityEl, setActivityEl, getIsUserScrolledUp, setIsUserScrolledUp, getStickyBottom, armStickyBottom, disarmStickyBottom, VENDOR_AVATARS, VENDOR_NAMES, VENDOR_HOMEPAGES } from './chat-render-runtime.js';
 export { addUserMessage, addSystemMessage, addConflictMessage, addContextOverflowMessage } from './app-message-cards.js';
 
 // --- Module-owned state (not in store) ---
@@ -44,7 +44,8 @@ export function addCopyHandler(msgEl, rawText) {
 }
 
 export function appendDelta(text) {
-  ensureAssistantBlock();
+  var assistantEl = ensureAssistantBlock();
+  if (store.get('replayingHistory')) addHistoryIndex(assistantEl, store.get('currentHistoryIndex'));
   streamBuffer += text;
   if (store.get('replayingHistory')) {
     store.set({ currentFullText: store.get('currentFullText') + streamBuffer });

package/lib/public/modules/chat-render-runtime.js

@@ -155,11 +155,19 @@ export function setIsUserScrolledUp(value) { isUserScrolledUp = value; }
 
 export function addToMessages(element) {
   var messagesEl = getMessagesEl();
+  addHistoryIndex(element, store.get('currentHistoryIndex'));
   if (prependAnchor) messagesEl.insertBefore(element, prependAnchor);
   else messagesEl.appendChild(element);
   keepActiveThinkingAtTail();
 }
 
+export function addHistoryIndex(element, historyIndex) {
+  if (!element || !Number.isSafeInteger(historyIndex) || historyIndex < 0) return;
+  var existing = element.dataset.historyIndexes || "";
+  if (existing.split(",").indexOf(String(historyIndex)) !== -1) return;
+  element.dataset.historyIndexes = existing ? existing + "," + historyIndex : String(historyIndex);
+}
+
 // Thinking is a single accumulating record for the active turn. Other live
 // transcript entries may arrive between reasoning segments, so keep only the
 // currently active record after the tail activity indicator.

package/lib/public/modules/clay-log-links.js

@@ -1,10 +1,33 @@
 import { enhanceClayIssueLinks, isExactClayIssueReference } from './clay-issue-links.js';
 import { enhanceGithubLinks } from './github-links.js';
+import { escapeHtml } from './utils.js';
 
 export function renderClayRecordLink(href, text) {
+  if (isExactClaySessionReference(href)) return renderClaySessionLink(href.trim(), text);
   if (!isExactClayLogReference(href) && !isExactClayIssueReference(href)) return null;
   return '<a href="#" data-clay-record-ref="' + href.trim() + '">' + text + '</a>';
 }
+
+export function isExactClaySessionReference(text) {
+  return parseClaySessionReference(text) !== null;
+}
+
+export function renderClaySessionLink(ref, text) {
+  var parsed = parseClaySessionReference(ref);
+  if (!parsed) return null;
+  var label = text ? String(text).trim() : "";
+  var safeLabel = escapeHtml(label);
+  var entryAttr = parsed.entryIndex === null ? "" : ' data-session-entry-index="' + parsed.entryIndex + '"';
+  return '<button type="button" class="clayos-session-link clayos-record-link" data-session-ref="' + parsed.ref + '"' + entryAttr + ' aria-label="Open session' + (safeLabel ? " from " + safeLabel : "") + '"><span>Session</span>' + (safeLabel ? '<small>' + safeLabel + '</small>' : '') + '</button>';
+}
+
+export function parseClaySessionReference(text) {
+  var match = /^((?:session:[A-Za-z0-9_-]{24}))(?:#entry-([0-9]+))?$/.exec((text || "").trim());
+  if (!match) return null;
+  var entryIndex = match[2] === undefined ? null : Number(match[2]);
+  if (entryIndex !== null && (!Number.isSafeInteger(entryIndex) || entryIndex < 0)) return null;
+  return { ref: match[1], entryIndex: entryIndex };
+}
 export function parseClayLogReferences(text) {
   var pattern = /\[clayos\/(log:[A-Za-z0-9_-]{24})(?:\s+[\u2014-]\s+([^\]\n]{1,80}))?\]|(^|[^A-Za-z0-9_/:])(log:[A-Za-z0-9_-]{24})(?![A-Za-z0-9_-])/g;
   var results = [];

package/lib/public/modules/command-palette.js

@@ -5,6 +5,8 @@ import { openSearch as openSessionSearch } from './session-search.js';
 import { startSearchClayChat, attachSearchClayChat, detachSearchClayChat, getSearchClayChatSummary } from './search-clay-chat.js';
 import { getWs } from './ws-ref.js';
 import { openProjectLog } from './project-logs.js';
+import { store } from './store.js';
+import { disarmStickyBottom } from './chat-render-runtime.js';
 
 function formatRelativeDate(ts) {
   if (!ts) return "";
@@ -70,6 +72,10 @@ function handleClaySessionLinkClick(event) {
   var requestId = "clayos-" + (isLog ? "log-" : "session-") + Date.now() + "-" + Math.random().toString(36).slice(2, 9);
   if (isLog) link.dataset.logRequest = requestId;
   else link.dataset.sessionRequest = requestId;
+  if (!isLog) store.set({ sessionNavigationRequestId: requestId, sessionNavigationRequestContext: {
+    projectSlug: store.get('currentSlug'),
+    sessionId: store.get('activeSessionId')
+  } });
   link.classList.remove("is-error");
   link.classList.add("is-loading");
   var request = { requestId: requestId, surface: link.closest(".search-clay-chat") ? "search" : "home" };
@@ -79,6 +85,7 @@ function handleClaySessionLinkClick(event) {
   } else {
     request.type = "home_clay_session_resolve";
     request.sessionRef = link.dataset.sessionRef;
+    if (link.dataset.sessionEntryIndex !== undefined) request.entryIndex = Number(link.dataset.sessionEntryIndex);
   }
   ws.send(JSON.stringify(request));
 }
@@ -91,12 +98,31 @@ export function handleClaySessionTarget(msg) {
   for (var i = 0; i < links.length; i++) {
     if ((isLog ? links[i].dataset.logRequest : links[i].dataset.sessionRequest) === msg.requestId) link = links[i];
   }
+  if (!isLog && store.get('sessionNavigationRequestId') !== msg.requestId) {
+    if (link) {
+      link.classList.remove("is-loading");
+      delete link.dataset.sessionRequest;
+    }
+    return true;
+  }
+  if (!isLog) {
+    var requestContext = store.get('sessionNavigationRequestContext');
+    if (requestContext && (String(store.get('currentSlug')) !== String(requestContext.projectSlug) || String(store.get('activeSessionId')) !== String(requestContext.sessionId))) {
+      if (link) {
+        link.classList.remove("is-loading");
+        delete link.dataset.sessionRequest;
+      }
+      store.set({ pendingSessionEntryNavigation: null, sessionNavigationRequestContext: null });
+      return true;
+    }
+  }
   if (link) {
     link.classList.remove("is-loading");
     if (isLog) delete link.dataset.logRequest;
     else delete link.dataset.sessionRequest;
   }
   if (msg.status !== "ready" || !msg.target) {
+    if (!isLog) store.set({ pendingSessionEntryNavigation: null });
     if (link) {
       link.classList.add("is-error");
       link.title = msg.error || "Item not available";
@@ -108,7 +134,7 @@ export function handleClaySessionTarget(msg) {
     navigateToLog(msg.target);
     return true;
   }
-  navigateToSession({ projectSlug: msg.target.projectSlug, sessionId: msg.target.sessionId }, null);
+  navigateToSession({ projectSlug: msg.target.projectSlug, sessionId: msg.target.sessionId }, null, msg.target.entryIndex);
   return true;
 }
 
@@ -151,9 +177,61 @@ export function handlePaletteSessionSwitch() {
   var nav = pendingNav;
   pendingNav = null;
   if (ctx.currentSlug && ctx.currentSlug() === nav.slug) {
-    ctx.selectSession(nav.sessionId);
-    if (nav.query) setTimeout(function () { openSessionSearch(nav.query); }, 400);
+    navigateToSession({ projectSlug: nav.slug, sessionId: nav.sessionId }, nav.query, nav.entryIndex);
+  }
+}
+
+export function handlePaletteHistoryDone() {
+  var pending = store.get('pendingSessionEntryNavigation');
+  if (!pending) return;
+  if (!isActiveEntryNavigation(pending)) {
+    store.set({ pendingSessionEntryNavigation: null });
+    return;
+  }
+  var historyFrom = store.get('historyFrom') || 0;
+  if (pending.entryIndex < historyFrom) {
+    var ws = getWs();
+    if (ws && ws.readyState === 1) ws.send(JSON.stringify({ type: "load_more_history", before: historyFrom, target: pending.entryIndex }));
+    return;
   }
+  jumpToSessionEntry(pending.entryIndex);
+}
+
+export function handlePaletteHistoryPrepended() {
+  var pending = store.get('pendingSessionEntryNavigation');
+  if (!pending) return;
+  if (!isActiveEntryNavigation(pending)) {
+    store.set({ pendingSessionEntryNavigation: null });
+    return;
+  }
+  requestAnimationFrame(function () {
+    if (store.get('pendingSessionEntryNavigation') === pending) jumpToSessionEntry(pending.entryIndex, pending);
+  });
+}
+
+function isActiveEntryNavigation(pending) {
+  return String(store.get('currentSlug') || (ctx && ctx.currentSlug ? ctx.currentSlug() : "")) === String(pending.projectSlug) && String(store.get('activeSessionId')) === String(pending.sessionId);
+}
+
+function jumpToSessionEntry(entryIndex, pending) {
+  if (pending && !isActiveEntryNavigation(pending)) return;
+  var messages = document.querySelectorAll("#messages [data-history-index], #messages [data-history-indexes]");
+  var target = null;
+  for (var i = 0; i < messages.length; i++) {
+    var indexes = (messages[i].dataset.historyIndexes || messages[i].dataset.historyIndex || "").split(",");
+    if (indexes.indexOf(String(entryIndex)) !== -1) { target = messages[i]; break; }
+  }
+  store.set({ pendingSessionEntryNavigation: null });
+  if (!target) return;
+  disarmStickyBottom();
+  var oldTargets = document.querySelectorAll("#messages .session-entry-target");
+  for (var oldIndex = 0; oldIndex < oldTargets.length; oldIndex++) oldTargets[oldIndex].classList.remove("session-entry-target");
+  var reducedMotion = window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+  target.scrollIntoView({ behavior: reducedMotion ? "auto" : "smooth", block: "center" });
+  target.classList.remove("session-entry-target");
+  void target.offsetWidth;
+  target.classList.add("session-entry-target");
+  setTimeout(function () { target.classList.remove("session-entry-target"); }, reducedMotion ? 700 : 1800);
 }
 
 function navigateToLog(target) {
@@ -357,13 +435,24 @@ function activateItem(entry) {
   if (entry.type === "mate-session" || entry.type === "session") navigateToSession(entry.data, entry.query);
 }
 
-function navigateToSession(item, query) {
+function navigateToSession(item, query, entryIndex) {
   closeCommandPalette();
+  pendingNav = null;
+  var hasEntry = entryIndex !== null && entryIndex !== undefined && Number.isSafeInteger(Number(entryIndex)) && Number(entryIndex) >= 0;
+  store.set({ pendingSessionEntryNavigation: hasEntry ? { projectSlug: item.projectSlug, sessionId: item.sessionId, entryIndex: Number(entryIndex) } : null });
   if (ctx.currentSlug && ctx.currentSlug() === item.projectSlug) {
+    var alreadyActive = String(store.get('activeSessionId')) === String(item.sessionId);
+    if (alreadyActive) {
+      if (query) setTimeout(function () { openSessionSearch(query); }, 400);
+      if (hasEntry) requestAnimationFrame(function () {
+        if (!store.get('replayingHistory')) handlePaletteHistoryDone();
+      });
+      return;
+    }
     ctx.selectSession(item.sessionId);
     if (query) setTimeout(function () { openSessionSearch(query); }, 400);
   } else {
-    pendingNav = { slug: item.projectSlug, sessionId: item.sessionId, query: query };
+    pendingNav = { slug: item.projectSlug, sessionId: item.sessionId, query: query, entryIndex: hasEntry ? Number(entryIndex) : null };
     ctx.switchProject(item.projectSlug);
   }
 }

package/lib/public/modules/markdown.js

@@ -84,7 +84,7 @@ export function enhanceClaySessionLinks(root) {
       fragment.appendChild(document.createTextNode(text.slice(offset, match.index)));
       var button = document.createElement("button");
       button.type = "button";
-      button.className = "clayos-session-link";
+      button.className = "clayos-session-link clayos-record-link";
       button.dataset.sessionRef = match[1];
       button.setAttribute("aria-label", "Open session" + (match[2] ? " from " + match[2].trim() : ""));
       var label = document.createElement("span");

package/lib/public/modules/passkey-browser.js

@@ -0,0 +1,69 @@
+function decode(value) {
+  var base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+  return Uint8Array.from(atob(base64), function (character) { return character.charCodeAt(0); });
+}
+function encode(value) {
+  var bytes = new Uint8Array(value); var binary = '';
+  bytes.forEach(function (byte) { binary += String.fromCharCode(byte); });
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+function serialize(credential) {
+  if (!credential) throw new Error('No passkey was selected.');
+  var response = { clientDataJSON: encode(credential.response.clientDataJSON) };
+  ['attestationObject', 'authenticatorData', 'signature', 'userHandle'].forEach(function (key) {
+    if (credential.response[key]) response[key] = encode(credential.response[key]);
+  });
+  if (credential.response.getTransports) response.transports = credential.response.getTransports();
+  return { id: credential.id, rawId: encode(credential.rawId), type: credential.type, response: response,
+    clientExtensionResults: credential.getClientExtensionResults(), authenticatorAttachment: credential.authenticatorAttachment };
+}
+function prepare(options) {
+  var publicKey = Object.assign({}, options, { challenge: decode(options.challenge) });
+  ['allowCredentials', 'excludeCredentials'].forEach(function (field) {
+    if (options[field]) publicKey[field] = options[field].map(function (key) { return Object.assign({}, key, { id: decode(key.id) }); });
+  });
+  if (options.user) publicKey.user = Object.assign({}, options.user, { id: decode(options.user.id) });
+  return publicKey;
+}
+export function supported() { return !!(window.isSecureContext && window.PublicKeyCredential && navigator.credentials); }
+export function passkeyError(error) {
+  if (error.name === 'NotAllowedError' || error.name === 'AbortError') return 'Passkey request cancelled or timed out. You can try again or use your password.';
+  if (error.name === 'InvalidStateError') return 'This passkey is already registered. Choose a different device or passkey.';
+  return error.message || 'Could not use this passkey.';
+}
+export async function createPasskey(options) {
+  if (!supported()) throw new Error('Passkeys need a supported browser and a secure connection.');
+  return serialize(await navigator.credentials.create({ publicKey: prepare(options) }));
+}
+export async function getPasskey(options) {
+  if (!supported()) throw new Error('Passkeys need a supported browser and a secure connection.');
+  return serialize(await navigator.credentials.get({ publicKey: prepare(options) }));
+}
+export async function request(url, data) {
+  var response = await fetch(url, data === undefined ? { credentials: 'same-origin' } : {
+    method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data),
+  });
+  var result = await response.json();
+  if (!response.ok) throw new Error(result.error || 'Could not complete this request.');
+  return result;
+}
+export async function initPasskeyLogin() {
+  var button = document.getElementById('passkey-login');
+  if (!button || !supported()) return;
+  try {
+    var status = await request('/auth/passkeys/status');
+    if (status.origin !== location.origin || document.getElementById('mode-row').hidden) return;
+    button.hidden = false;
+    button.onclick = async function () {
+      button.disabled = true;
+      var error = document.getElementById('error'); error.textContent = '';
+      try {
+        var options = await request('/auth/passkeys/login/options', {});
+        var response = await getPasskey(options.options);
+        await request('/auth/passkeys/login/verify', { response: response });
+        location.href = '/';
+      } catch (failure) { error.textContent = passkeyError(failure); }
+      finally { button.disabled = false; }
+    };
+  } catch (failure) { /* Password sign-in remains available when passkeys cannot load. */ }
+}

package/lib/public/modules/passkey-server-settings.js

@@ -0,0 +1,57 @@
+import { store } from './store.js';
+import { setSettingsDraft, clearSettingsDraft } from './server-settings-state.js';
+
+function render(state) {
+  var section = document.getElementById('passkey-policy');
+  if (!section) return;
+  section.hidden = !state.available;
+  var input = section.querySelector('[name=origin]');
+  if (state.draft === undefined) input.value = state.origin || '';
+  input.disabled = !!state.pending || !!state.locked;
+  section.querySelector('[name=currentPassword]').disabled = !!state.pending;
+  section.querySelector('button').disabled = !!state.pending || !!state.locked;
+  section.querySelector('[data-passkey-editor]').hidden = !!state.locked;
+  section.querySelector('[role=status]').textContent = state.error || (state.pending ? 'Saving…' : state.origin ?
+    'Passkeys are available at ' + state.origin + (state.locked ? '. Remove registered passkeys before changing this address.' : '.') : 'Not configured. Password sign-in remains available.');
+}
+export async function loadPasskeyServerSettings() {
+  if (!document.getElementById('passkey-policy') || (store.get('passkeyPolicy') || {}).draft !== undefined) return;
+  try {
+    var response = await fetch('/api/passkey-policy'); var data = await response.json();
+    if (!response.ok) throw new Error(data.error || 'Could not load passkey settings.');
+    store.set({ passkeyPolicy: data }); render(data);
+  } catch (error) {
+    var state = Object.assign({}, store.get('passkeyPolicy'), { error: error.message });
+    store.set({ passkeyPolicy: state }); render(state);
+  }
+}
+export function initPasskeyServerSettings() {
+  var anchor = document.getElementById('account-auth-policy');
+  if (!anchor || document.getElementById('passkey-policy')) return;
+  var section = document.createElement('section'); section.id = 'passkey-policy'; section.className = 'settings-card'; section.hidden = true;
+  section.innerHTML = '<h3>Passkey sign-in address</h3><p class="settings-hint">Configure the shared server address for passkey sign-in. Users register and manage their own passkeys in Personal settings → Account. Passwords remain available.</p>' +
+    '<form><label class="settings-label" for="passkey-origin">Sign-in address</label><input class="us-text-input" id="passkey-origin" name="origin" type="url" placeholder="https://clay.example.com" required>' +
+    '<p class="settings-hint">Use the permanent HTTPS address for this server. Local development can use http://localhost with its port.</p>' +
+    '<div data-passkey-editor><label class="settings-label" for="passkey-admin-password">Administrator password</label><input class="us-text-input" id="passkey-admin-password" name="currentPassword" type="password" autocomplete="current-password" required>' +
+    '<div class="settings-form-actions"><button class="settings-btn-sm" type="submit">Save passkey address</button></div></div></form><p class="settings-hint" role="status"></p>';
+  anchor.after(section);
+  var input = section.querySelector('[name=origin]');
+  input.oninput = function () {
+    var state = Object.assign({}, store.get('passkeyPolicy'), { draft: input.value, error: '' });
+    if (input.value === (state.origin || '')) { delete state.draft; clearSettingsDraft('passkeys'); }
+    else setSettingsDraft('passkeys', true);
+    store.set({ passkeyPolicy: state }); render(state);
+  };
+  section.querySelector('form').onsubmit = async function (event) {
+    event.preventDefault();
+    var state = Object.assign({}, store.get('passkeyPolicy'), { pending: true, error: '' });
+    store.set({ passkeyPolicy: state }); render(state);
+    var password = section.querySelector('[name=currentPassword]');
+    try {
+      var response = await fetch('/api/passkey-policy', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ origin: input.value, currentPassword: password.value }) });
+      var data = await response.json(); if (!response.ok) throw new Error(data.error || 'Could not save passkey settings.');
+      state = data; clearSettingsDraft('passkeys');
+    } catch (error) { state.pending = false; state.error = error.message; }
+    finally { password.value = ''; store.set({ passkeyPolicy: state }); render(state); }
+  };
+}

package/lib/public/modules/project-logs-render.js

@@ -366,11 +366,12 @@ export function renderDetail(detailEl, entry, handlers) {
     formatTime(entry.updatedAt || entry.createdAt),
   ].filter(Boolean).join(" · ");
   setText(header, ".project-log-byline", byline);
-  if (handlers && handlers.canDelete && !entry.scheduledResult) {
+  if (handlers && handlers.canDelete && !entry.scheduledResult && !entry.deleted) {
     var deleteButton = document.createElement("button");
     deleteButton.type = "button";
     deleteButton.className = "project-log-delete-button";
-    deleteButton.innerHTML = '<i data-lucide="trash-2"></i><span>Delete log</span>';
+    deleteButton.innerHTML = '<i data-lucide="trash-2"></i><span></span>';
+    deleteButton.querySelector("span").textContent = handlers.deleteLabel || "Delete log";
     deleteButton.addEventListener("click", function () { handlers.onDelete(entry); });
     header.appendChild(deleteButton);
   }

package/lib/public/modules/server-settings-controls.js

@@ -10,6 +10,7 @@ function status(id, text) {
 }
 
 function sendSetting(type, values, buttonId, statusId) {
+  if (type === 'set_pin' && store.get('serverPinAvailable') !== true) return;
   var ws = getWs();
   if (!ws || ws.readyState !== 1) { status(statusId, 'Disconnected. Your change has not been saved.'); return; }
   var button = document.getElementById(buttonId);
@@ -29,6 +30,15 @@ function sendSetting(type, values, buttonId, statusId) {
   }, 12000);
 }
 
+export function setServerPinAvailability(available) {
+  store.set({ serverPinAvailable: !!available });
+  var section = document.getElementById('settings-server-pin');
+  if (!section) return;
+  section.hidden = !available;
+  section.querySelectorAll('input,button').forEach(function (element) { element.disabled = !available; });
+  if (!available) hidePinForm();
+}
+
 export function handleServerSettingResult(msg) {
   var type = msg.type.replace(/_result$/, '');
   var pending = Object.assign({}, store.get('serverSettingsPending') || {});