clay-server 5.2.0-beta.1 → 5.2.0-beta.11

package/lib/sessions.js

@@ -3,7 +3,7 @@ var path = require("path");
 var config = require("./config");
 var utils = require("./utils");
 var users = require("./users");
-var { CODEX_DEFAULTS } = require("./codex-defaults");
+var providerDefaults = require("./yoke/settings").defaults();
 var hygiene = require("./session-hygiene");
 var backgroundTaskTiming = require("./background-task-timing");
 var sessionProvenance = require("./session-provenance");
@@ -39,16 +39,16 @@ function createSessionManager(opts) {
   var permissionRequestIndex = {}; // requestId -> sessionLocalId (O(1) lookup)
   var capabilitiesByVendor = null; // set by sdk-bridge after adapter init
   var defaultVendor = null;        // set by sdk-bridge
-  var codexApproval = CODEX_DEFAULTS.approval;
-  var codexSandbox = CODEX_DEFAULTS.sandbox;
-  var codexWebSearch = CODEX_DEFAULTS.webSearch;
+  var codexApproval = providerDefaults.codexApproval;
+  var codexSandbox = providerDefaults.codexSandbox;
+  var codexWebSearch = providerDefaults.codexWebSearch;
 
   // --- Session persistence (centralized in ~/.clay/sessions/{encoded-cwd}/) ---
   var sessionsBase = opts.sessionsBase || path.join(config.CONFIG_DIR, "sessions");
   var encodedCwd = utils.resolveEncodedDir(sessionsBase, cwd);
   var sessionsDir = path.join(sessionsBase, encodedCwd);
   fs.mkdirSync(sessionsDir, { recursive: true });
-  var cliSessionsDir = opts.cliSessionsDir || path.join(config.REAL_HOME, ".claude", "projects", utils.encodeCwd(cwd));
+  var cliSessionsDir = opts.cliSessionsDir || require("./yoke/legacy-sessions").directory(config.REAL_HOME, cwd);
   var deletedCliSessionsPath = path.join(sessionsDir, "deleted-cli-sessions.json");
   var deletedCliSessionIds = new Set();
   try {
@@ -77,29 +77,6 @@ function createSessionManager(opts) {
     }
   }
 
-  function readCliTranscriptHead(filePath) {
-    var MAX_READ = 64 * 1024;
-    try {
-      var stat = fs.statSync(filePath);
-      var fd = fs.openSync(filePath, "r");
-      var bytesToRead = Math.min(stat.size, MAX_READ);
-      var buf = Buffer.alloc(bytesToRead);
-      fs.readSync(fd, buf, 0, bytesToRead, 0);
-      fs.closeSync(fd);
-      var lines = buf.toString("utf8").split("\n");
-      var events = [];
-      for (var i = 0; i < lines.length; i++) {
-        if (!lines[i]) continue;
-        try {
-          var event = JSON.parse(lines[i]);
-          if (event && typeof event === "object") events.push(event);
-        } catch (e) {}
-      }
-      return events;
-    } catch (e) {
-      return null;
-    }
-  }
 
   // Auto-migrate sessions from legacy locations:
   //   v1: {cwd}/.claude-relay/sessions/
@@ -179,6 +156,7 @@ function createSessionManager(opts) {
       };
       if (session.githubLinks) metaObj.githubLinks = session.githubLinks;
       if (session.linearLinks) metaObj.linearLinks = session.linearLinks;
+      if (session.workPrimary) metaObj.workPrimary = session.workPrimary;
       if (session.ownerId) metaObj.ownerId = session.ownerId;
       if (session.vendor) metaObj.vendor = session.vendor;
       if (session.codexDynamicToolCatalogVersion) metaObj.codexDynamicToolCatalogVersion = session.codexDynamicToolCatalogVersion;
@@ -188,6 +166,7 @@ function createSessionManager(opts) {
       if (session.codexLinearToolCatalogVersion) metaObj.codexLinearToolCatalogVersion = session.codexLinearToolCatalogVersion;
       if (session.codexSharedBrowserToolCatalogVersion) metaObj.codexSharedBrowserToolCatalogVersion = session.codexSharedBrowserToolCatalogVersion;
       if (session.codexIssuesToolCatalogVersion) metaObj.codexIssuesToolCatalogVersion = session.codexIssuesToolCatalogVersion;
+      if (session.codexNotesToolCatalogVersion) metaObj.codexNotesToolCatalogVersion = session.codexNotesToolCatalogVersion;
       if (session.model) metaObj.model = session.model;
       if (session.effort) metaObj.effort = session.effort;
       // Persist the session's "born" mode so TUI sessions reappear after a
@@ -226,10 +205,18 @@ function createSessionManager(opts) {
       if (session.homeDebatePlanning) metaObj.homeDebatePlanning = true;
       if (session.homeDebatePhase) metaObj.homeDebatePhase = session.homeDebatePhase;
       if (session.homeDebateInitialTopic) metaObj.homeDebateInitialTopic = session.homeDebateInitialTopic;
+      if (session.mateScheduleDraft) metaObj.mateScheduleDraft = session.mateScheduleDraft;
+      if (session.mateSchedules) metaObj.mateSchedules = session.mateSchedules;
+      if (session.clayWorkspaceReceipts) metaObj.clayWorkspaceReceipts = session.clayWorkspaceReceipts;
+      if (session.clayMateChatReceipts) metaObj.clayMateChatReceipts = session.clayMateChatReceipts;
+      if (session.claySchedulingReceipts) metaObj.claySchedulingReceipts = session.claySchedulingReceipts;
       if (session.mateCreationMode) metaObj.mateCreationMode = true;
       if (session.homeMateCreationPhase) metaObj.homeMateCreationPhase = session.homeMateCreationPhase;
+      if (session.contextualCreationMateStamp) metaObj.contextualCreationMateStamp = session.contextualCreationMateStamp;
+      if (session.contextualCreationRequestId) metaObj.contextualCreationRequestId = session.contextualCreationRequestId;
       if (session.homeClayEntryRequestId) metaObj.homeClayEntryRequestId = session.homeClayEntryRequestId;
       if (session.homeClayEntryMode) metaObj.homeClayEntryMode = session.homeClayEntryMode;
+      if (session.homeClayEntryText) metaObj.homeClayEntryText = session.homeClayEntryText;
       metaObj.sessionOriginId = provenanceMeta.sessionOriginId;
       if (provenanceMeta.sessionProvenance) metaObj.sessionProvenance = provenanceMeta.sessionProvenance;
       if (Array.isArray(session._workerGenerations)) metaObj.workerGenerations = session._workerGenerations;
@@ -356,6 +343,7 @@ function createSessionManager(opts) {
         titleAutoGenerated: m.titleAutoGenerated === true,
         githubLinks: Array.isArray(m.githubLinks) ? m.githubLinks.slice(0, 8) : [],
         linearLinks: Array.isArray(m.linearLinks) ? m.linearLinks.slice(0, 8) : [],
+        workPrimary: m.workPrimary || {},
         titleManuallySet: m.titleManuallySet === true || legacyTitleProtected,
         createdAt: m.createdAt || Date.now(),
         lastActivity: loaded[i].mtime || m.createdAt || Date.now(),
@@ -371,6 +359,7 @@ function createSessionManager(opts) {
       session.codexLinearToolCatalogVersion = Number(m.codexLinearToolCatalogVersion || 0);
       session.codexSharedBrowserToolCatalogVersion = Number(m.codexSharedBrowserToolCatalogVersion || 0);
       session.codexIssuesToolCatalogVersion = Number(m.codexIssuesToolCatalogVersion || 0);
+      session.codexNotesToolCatalogVersion = Number(m.codexNotesToolCatalogVersion || 0);
       session.model = m.model || deriveSessionModel(loaded[i].history);
       session.effort = m.effort || null;
       if (m.loop) session.loop = m.loop;
@@ -384,10 +373,18 @@ function createSessionManager(opts) {
       if (m.homeDebatePlanning) session.homeDebatePlanning = true;
       if (m.homeDebatePhase) session.homeDebatePhase = m.homeDebatePhase;
       if (m.homeDebateInitialTopic) session.homeDebateInitialTopic = m.homeDebateInitialTopic;
+      if (m.mateScheduleDraft) session.mateScheduleDraft = m.mateScheduleDraft;
+      if (m.mateSchedules) session.mateSchedules = m.mateSchedules;
+      if (Array.isArray(m.clayWorkspaceReceipts)) session.clayWorkspaceReceipts = m.clayWorkspaceReceipts;
+      if (Array.isArray(m.clayMateChatReceipts)) session.clayMateChatReceipts = m.clayMateChatReceipts;
+      if (Array.isArray(m.claySchedulingReceipts)) session.claySchedulingReceipts = m.claySchedulingReceipts;
       if (m.mateCreationMode) session.mateCreationMode = true;
       if (m.homeMateCreationPhase) session.homeMateCreationPhase = m.homeMateCreationPhase;
+      if (m.contextualCreationMateStamp) session.contextualCreationMateStamp = m.contextualCreationMateStamp;
+      if (m.contextualCreationRequestId) session.contextualCreationRequestId = m.contextualCreationRequestId;
       if (m.homeClayEntryRequestId) session.homeClayEntryRequestId = m.homeClayEntryRequestId;
       if (m.homeClayEntryMode) session.homeClayEntryMode = m.homeClayEntryMode;
+      if (m.homeClayEntryText) session.homeClayEntryText = m.homeClayEntryText;
       if (m.ownerId) session.ownerId = m.ownerId;
       session.sessionOriginId = m.sessionOriginId || null;
       session._provenanceMigrationNeeded = sessionProvenance.restore(m, session);
@@ -458,9 +455,6 @@ function createSessionManager(opts) {
   //   - Warmup shape: 1 real "hi" prompt, optional automatic interruption,
   //     and 0 assistant messages (covered by daemon cleanup but defensive)
   function adoptOrphanedCliSessions() {
-    var files;
-    try { files = fs.readdirSync(cliSessionsDir); } catch (e) { return; }
-
     // Build set of cliSessionIds Clay already tracks
     var knownCliIds = new Set();
     sessions.forEach(function (s) {
@@ -469,56 +463,10 @@ function createSessionManager(opts) {
 
     var adopted = 0;
 
-    for (var i = 0; i < files.length; i++) {
-      if (!files[i].endsWith(".jsonl")) continue;
-      var cliSid = files[i].slice(0, -".jsonl".length);
-      if (knownCliIds.has(cliSid)) continue;
-      if (deletedCliSessionIds.has(cliSid)) continue;
-
-      var fp = path.join(cliSessionsDir, files[i]);
-      var events = readCliTranscriptHead(fp);
-      if (!events) continue;
-      var userCount = 0;
-      var firstUserText = null;
-      var createdAtIso = null;
-      for (var li = 0; li < events.length; li++) {
-        var ev = events[li];
-        if (ev.type === "user" && ev.message && ev.message.role === "user") {
-          userCount++;
-          if (firstUserText == null) {
-            var c = ev.message.content;
-            if (typeof c === "string") {
-              firstUserText = c;
-            } else if (Array.isArray(c)) {
-              var parts = [];
-              for (var ci = 0; ci < c.length; ci++) {
-                if (c[ci] && c[ci].type === "text" && typeof c[ci].text === "string") parts.push(c[ci].text);
-              }
-              firstUserText = parts.join("");
-            }
-            if (ev.timestamp && !createdAtIso) createdAtIso = ev.timestamp;
-          }
-        }
-      }
-
-      if (userCount === 0) continue;
-      // Defensive warmup skip (daemon also cleans these)
-      if (hygiene.isClaudeWarmupTranscript(events)) continue;
-
-      // Title: first user message trimmed/truncated. Fall back to a
-      // neutral label so the sidebar entry is identifiable.
-      var title = (firstUserText || "").trim().replace(/\s+/g, " ");
-      if (title.length > 60) title = title.slice(0, 57) + "...";
-      if (!title) title = "Imported CLI session";
-
-      var createdAt = Date.now();
-      if (createdAtIso) {
-        var t = Date.parse(createdAtIso);
-        if (!isNaN(t)) createdAt = t;
-      }
-      var lastActivity = createdAt;
-      try { lastActivity = fs.statSync(fp).mtimeMs; } catch (e) {}
-
+    var candidates = require("./yoke/legacy-sessions").candidates(cliSessionsDir, knownCliIds, deletedCliSessionIds);
+    for (var i = 0; i < candidates.length; i++) {
+      var candidate = candidates[i], cliSid = candidate.id;
+      var title = candidate.title, createdAt = candidate.createdAt, lastActivity = candidate.lastActivity;
       var localId = nextLocalId++;
       var session = {
         localId: localId,
@@ -536,7 +484,7 @@ function createSessionManager(opts) {
         history: [],
         messageUUIDs: [],
         lastRewindUuid: null,
-        vendor: "claude",
+        vendor: candidate.vendor,
         mode: "tui",
         // Adopted from an external `claude` run in this cwd, not started by
         // Clay. Notification emitters must stay silent for these until the
@@ -568,10 +516,7 @@ function createSessionManager(opts) {
     var stale = [];
     sessions.forEach(function (session) {
       if (!session.adopted || !session.cliSessionId) return;
-      var transcriptPath = path.join(cliSessionsDir, session.cliSessionId + ".jsonl");
-      var events = readCliTranscriptHead(transcriptPath);
-      var missingEmptySource = !fs.existsSync(transcriptPath) && (!session.history || session.history.length === 0);
-      if (missingEmptySource || (events && hygiene.isClaudeWarmupTranscript(events))) stale.push(session.localId);
+      if (require("./yoke/legacy-sessions").obsolete(cliSessionsDir, session)) stale.push(session.localId);
     });
     for (var i = 0; i < stale.length; i++) deleteSessionQuiet(stale[i]);
     if (stale.length > 0) {
@@ -624,11 +569,13 @@ function createSessionManager(opts) {
     var unreadMap = wsUnread || singleUserUnread;
     return {
       id: s.localId,
+      sessionOriginId: s.sessionOriginId || null,
       cliSessionId: s.cliSessionId || null,
       createdAt: s.createdAt || 0,
       title: s.title || "New Session",
       githubLinks: s.githubLinks || [],
       linearLinks: s.linearLinks || [],
+      workPrimary: s.workPrimary || {},
       active: isActive,
       isProcessing: s.isProcessing,
       // Sidebar badge: user work only. Ambient housekeeping is surfaced in the
@@ -833,8 +780,8 @@ function createSessionManager(opts) {
   }
 
   // History entries include tool activity and streamed output, so opening a
-  // conversation needs a wider window than each incremental scroll-up page.
-  var INITIAL_HISTORY_SIZE = 500;
+  // conversation starts with a 300-entry target, aligned to a complete user turn.
+  var INITIAL_HISTORY_SIZE = 300;
   var HISTORY_PAGE_SIZE = 100;
 
   function findTurnBoundary(history, targetIndex) {
@@ -844,8 +791,9 @@ function createSessionManager(opts) {
     return 0;
   }
 
-  function replayHistory(session, fromIndex, targetWs, transform) {
-    var _send = (targetWs && sendTo) ? function (obj) { sendTo(targetWs, obj); } : send;
+  function replayHistory(session, fromIndex, targetWs, transform, snapshotSend) {
+    var _send = snapshotSend || ((targetWs && sendTo) ? function (obj) { sendTo(targetWs, obj); } : send);
+    var sendHistory = snapshotSend && snapshotSend.history || _send;
     var total = session.history.length;
     if (typeof fromIndex !== "number") {
       if (total <= INITIAL_HISTORY_SIZE) {
@@ -855,7 +803,7 @@ function createSessionManager(opts) {
       }
     }
 
-    _send({ type: "history_meta", total: total, from: fromIndex });
+    sendHistory({ type: "history_meta", total: total, from: fromIndex });
 
     for (var i = fromIndex; i < total; i++) {
       var _item = session.history[i];
@@ -864,7 +812,10 @@ function createSessionManager(opts) {
       if (_item && (_item.type === "mention_user" || _item.type === "mention_response")) {
         console.log("[DEBUG replayHistory] sending mention at index=" + i + " from=" + fromIndex + " total=" + total + " type=" + _item.type + " mate=" + (_item.mateName || ""));
       }
-      _send(transform ? transform(_item) : _item);
+      var normalizedItem = require("./yoke/usage").clientEvent(_item, session.vendor || "claude");
+      var replayItem = transform ? transform(normalizedItem) : normalizedItem;
+      if (replayItem && typeof replayItem === "object") replayItem = Object.assign({}, replayItem, { _historyIndex: i });
+      sendHistory(replayItem);
     }
 
     // Find the last result message in the full history for accurate context data
@@ -872,9 +823,11 @@ function createSessionManager(opts) {
     var lastModelUsage = null;
     var lastCost = null;
     var lastStreamInputTokens = null;
+    var lastContext = null;
     for (var j = total - 1; j >= 0; j--) {
       if (session.history[j].type === "result") {
-        var r = session.history[j];
+        var r = require("./yoke/usage").clientEvent(session.history[j], session.vendor || "claude");
+        lastContext = r.context || null;
         lastUsage = r.usage || null;
         lastModelUsage = r.modelUsage || null;
         lastCost = r.cost != null ? r.cost : null;
@@ -883,16 +836,17 @@ function createSessionManager(opts) {
       }
     }
 
-    _send({ type: "history_done", lastUsage: lastUsage, lastModelUsage: lastModelUsage, lastCost: lastCost, lastStreamInputTokens: lastStreamInputTokens, contextUsage: session.lastContextUsage || null });
+    sendHistory({ type: "history_done", controlHistoryRevision: require("./clay-control-target-projection").digest(session.history || []), sessionId: session.localId, sessionOriginId: session.sessionOriginId || null, lastUsage: lastUsage, lastModelUsage: lastModelUsage, lastCost: lastCost, lastStreamInputTokens: lastStreamInputTokens, context: lastContext, contextUsage: require("./yoke/usage").context(session.lastContextUsage, session.vendor || "claude") });
     for (var vi = 0; vi < sessionViewedListeners.length; vi++) {
       try { sessionViewedListeners[vi](session, targetWs, _send); } catch (e) {}
     }
   }
 
-  function switchSession(localId, targetWs, transform) {
+  function switchSession(localId, targetWs, transform, snapshotSend, snapshotGuard) {
     var session = sessions.get(localId);
     if (!session) return;
     if (typeof onSessionHydrate === "function") onSessionHydrate(session);
+    if (snapshotGuard && !snapshotGuard()) return;
 
     // Pane sockets (split-view iframes) pin their session via switch_session
     // but must not move the project-global active pointer: reloads and
@@ -913,7 +867,7 @@ function createSessionManager(opts) {
     singleUserUnread[localId] = 0;
 
     // In multi-user mode with a specific client, only send to that client
-    var _send = (targetWs && sendTo) ? function (obj) { sendTo(targetWs, obj); } : send;
+    var _send = snapshotSend || ((targetWs && sendTo) ? function (obj) { sendTo(targetWs, obj); } : send);
 
     var _capsByVendor = capabilitiesByVendor || {};
     var _sessionVendor = session.vendor || defaultVendor || "claude";
@@ -926,7 +880,7 @@ function createSessionManager(opts) {
       || [];
     _send({ type: "slash_commands", commands: _vendorCmds, vendor: _sessionVendor });
     broadcastSessionList();
-    replayHistory(session, undefined, targetWs, transform);
+    replayHistory(session, undefined, targetWs, transform, snapshotSend);
 
     if (session.isProcessing) {
       _send({ type: "status", status: "processing" });
@@ -944,10 +898,15 @@ function createSessionManager(opts) {
         toolInput: p.toolInput,
         toolUseId: p.toolUseId,
         decisionReason: p.decisionReason,
+        defaultToNo: p.defaultToNo,
+        suppressAlwaysAllowRule: p.suppressAlwaysAllowRule,
+        mateId: p.mateId || undefined,
+        vendor: p.vendor || session.vendor || undefined,
       });
     }
 
     // Re-send active mention indicator so returning clients restore the mate avatar state
+    if (snapshotSend) require('./pane-pending-interactions').send(session, _send);
     if (session._mentionInProgress && session._mentionActiveMateId) {
       _send({ type: "mention_processing", mateId: session._mentionActiveMateId, active: true });
     }
@@ -1080,6 +1039,14 @@ function createSessionManager(opts) {
     }
   }
 
+  // An activated pane socket only accepts frames carrying its exact binding;
+  // the transport adds it, or withholds the frame if the binding is stale.
+  function sendLiveToSocket(ws, session, obj, data) {
+    if (!ws._clayPaneActivation) { ws.send(data); return; }
+    var panePayload = require("./pane-session-transport").outbound(ws, obj, session.localId);
+    if (panePayload) ws.send(JSON.stringify(panePayload));
+  }
+
   function doSendToSession(session, obj) {
     // Send to active clients without recording to history/disk (ephemeral data)
     if (sendEach) {
@@ -1088,7 +1055,7 @@ function createSessionManager(opts) {
         if (filterFn && !filterFn(session)) return;
         if (session.homeDebatePlanning === true) return;
         if (ws._clayActiveSession === session.localId && ws.readyState === 1) {
-          ws.send(data);
+          sendLiveToSocket(ws, session, obj, data);
         }
       });
     } else if (session.localId === activeSessionId) {
@@ -1120,7 +1087,7 @@ function createSessionManager(opts) {
         if (filterFn && !filterFn(session)) return;
         if (session.homeDebatePlanning === true) return;
         if (ws._clayActiveSession === session.localId) {
-          if (ws.readyState === 1) ws.send(data);
+          if (ws.readyState === 1) sendLiveToSocket(ws, session, outgoingObj, data);
         } else if (session.isProcessing && !session._ioThrottle) {
           if (!ioData) ioData = JSON.stringify({ type: "session_io", id: session.localId });
           if (ws.readyState === 1) ws.send(ioData);

package/lib/shared-browser-cookie-sync.js

@@ -0,0 +1,32 @@
+var cookieKey = require('./shared-browser-cookies').cookieKey;
+
+// Only the private worker pipe carries cookies. They never enter browser state or tool output.
+function attachCookieSync(context, initial, send) {
+  var pending = null;
+  var previous = initial;
+  var nextId = 0;
+  function receive(message) {
+    if (!pending || pending.id !== message.id) return;
+    var entry = pending; pending = null; clearTimeout(entry.timer);
+    if (message.error) entry.reject(new Error(message.error));
+    else entry.resolve(message.cookies);
+  }
+  async function sync() {
+    var current = await context.cookies();
+    var cookies = await new Promise(function (resolve, reject) {
+      pending = { id: ++nextId, resolve: resolve, reject: reject, timer: setTimeout(function () { pending = null; reject(new Error('Could not synchronize browser cookies')); }, 4000) };
+      try { send({ type: 'cookies', id: pending.id, previous: previous, cookies: current }); }
+      catch (error) { clearTimeout(pending.timer); pending = null; reject(error); }
+    });
+    var remote = new Map(cookies.map(function (cookie) { return [cookieKey(cookie), cookie]; }));
+    var local = new Map(current.map(function (cookie) { return [cookieKey(cookie), cookie]; }));
+    var updates = cookies.filter(function (cookie) { return JSON.stringify(local.get(cookieKey(cookie))) !== JSON.stringify(cookie); });
+    current.forEach(function (cookie) {
+      if (!remote.has(cookieKey(cookie))) updates.push(Object.assign({}, cookie, { expires: 1 }));
+    });
+    if (updates.length) await context.addCookies(updates);
+    previous = cookies;
+  }
+  return { start: function () { return context.addCookies(initial); }, sync: sync, receive: receive };
+}
+module.exports = { attachCookieSync: attachCookieSync };

package/lib/shared-browser-cookies.js

@@ -0,0 +1,79 @@
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+
+function cookieKey(cookie) {
+  return JSON.stringify([cookie.domain, cookie.path, cookie.name, cookie.partitionKey || '']);
+}
+function cookieMap(cookies) {
+  if (!Array.isArray(cookies) || cookies.length > 10000 || JSON.stringify(cookies).length > 2 * 1024 * 1024) throw new Error('Browser cookies exceed the storage limit');
+  var result = new Map();
+  cookies.forEach(function (cookie) {
+    if (!cookie || typeof cookie.name !== 'string' || typeof cookie.value !== 'string' || typeof cookie.domain !== 'string' || typeof cookie.path !== 'string') throw new Error('Invalid browser cookie');
+    result.set(cookieKey(cookie), cookie);
+  });
+  return result;
+}
+function same(a, b) { return JSON.stringify(a) === JSON.stringify(b); }
+
+// Merge only a tab's changes, so an idle tab cannot overwrite another tab's login or logout.
+function mergeCookies(saved, previous, current) {
+  var merged = cookieMap(saved), before = cookieMap(previous), after = cookieMap(current);
+  before.forEach(function (cookie, key) {
+    if (!after.has(key) && same(merged.get(key), cookie)) merged.delete(key);
+  });
+  after.forEach(function (cookie, key) {
+    if (!same(before.get(key), cookie)) merged.set(key, cookie);
+  });
+  return Array.from(merged.values()).filter(function (cookie) { return cookie.expires === -1 || cookie.expires > Date.now() / 1000; });
+}
+
+function attachEncryptedStore(root, name, empty) {
+  var directory = path.join(root, name);
+  function ownerKey(owner) {
+    if (typeof owner !== 'string' || !owner || owner.length > 256) throw new Error('Browser data owner is required');
+    return crypto.createHash('sha256').update(owner).digest('hex');
+  }
+  function masterKey() {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    var file = path.join(directory, '.key');
+    try { fs.writeFileSync(file, crypto.randomBytes(32), { flag: 'wx', mode: 0o600 }); }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+    return fs.readFileSync(file);
+  }
+  function read(owner) {
+    var id = ownerKey(owner), raw;
+    try { raw = fs.readFileSync(path.join(directory, id + '.json'), 'utf8'); }
+    catch (error) { if (error.code === 'ENOENT') return empty(); throw new Error('Could not read saved browser data'); }
+    try {
+      var parts = JSON.parse(raw).map(function (part) { return Buffer.from(part, 'base64'); });
+      var cipher = crypto.createDecipheriv('aes-256-gcm', masterKey(), parts[0]);
+      cipher.setAAD(Buffer.from(id)); cipher.setAuthTag(parts[1]);
+      var cookies = JSON.parse(Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8'));
+      return cookies;
+    } catch (error) { throw new Error('Could not decrypt saved browser data'); }
+  }
+  function write(owner, cookies) {
+    var id = ownerKey(owner), iv = crypto.randomBytes(12);
+    var cipher = crypto.createCipheriv('aes-256-gcm', masterKey(), iv);
+    cipher.setAAD(Buffer.from(id));
+    var bytes = Buffer.concat([cipher.update(JSON.stringify(cookies), 'utf8'), cipher.final()]);
+    var file = path.join(directory, id + '.json'), temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
+    try {
+      fs.writeFileSync(temp, JSON.stringify([iv, cipher.getAuthTag(), bytes].map(function (part) { return part.toString('base64'); })), { mode: 0o600 });
+      fs.renameSync(temp, file);
+    } finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+    return cookies;
+  }
+  return { read: read, write: write };
+}
+function attachCookieStore(root) {
+  var disk = attachEncryptedStore(root, 'browser-cookies', function () { return []; });
+  function read(owner) { return mergeCookies(disk.read(owner), [], []); }
+  return { read: read, clear: function (owner) { disk.write(owner, []); }, exchange: function (owner, previous, current) {
+    var saved = read(owner), merged = mergeCookies(saved, previous, current);
+    if (!same(saved, merged)) disk.write(owner, merged);
+    return merged;
+  } };
+}
+module.exports = { attachEncryptedStore: attachEncryptedStore, attachCookieStore: attachCookieStore, mergeCookies: mergeCookies, cookieKey: cookieKey };

package/lib/shared-browser-runtime.js

@@ -5,6 +5,8 @@ var buildUserEnv = require("./build-user-env").buildUserEnv;
 var wrapSpawnAsUser = require("./os-users").wrapSpawnAsUser;
 
 function createRuntime(options) {
+  var initialStorage = options.storage ? options.storage.read() : null;
+  var initialCookies = options.cookies ? options.cookies.read() : null;
   var identity = options.identity;
   var env = buildUserEnv(identity);
   if (process.platform === "win32" && !identity) {
@@ -14,7 +16,9 @@ function createRuntime(options) {
   if (identity) { opts.uid = identity.uid; opts.gid = identity.gid; }
   var spec = wrapSpawnAsUser(process.execPath, [path.join(__dirname, "shared-browser-worker.js")], opts);
   var child = spawn(spec.command, spec.args, spec.options);
+  var exited = new Promise(function (resolve) { child.once("close", resolve); });
   var closed = false;
+  var closing = false;
   var nextId = 0;
   var pending = new Map();
   var buffer = "";
@@ -25,19 +29,30 @@ function createRuntime(options) {
   function fail(message) {
     pending.forEach(function (entry) { clearTimeout(entry.timer); entry.reject(new Error(message)); });
     pending.clear();
-    if (!closed) options.onEvent({ type: "error", error: message });
+    if (!closed && !closing) options.onEvent({ type: "error", error: message });
   }
   child.stdin.on("error", function () {});
   child.stdout.setEncoding("utf8");
   child.stdout.on("data", function (chunk) {
     buffer += chunk;
-    if (buffer.length > 8 * 1024 * 1024) { fail("Browser response too large"); child.kill(); return; }
+    if (buffer.length > 32 * 1024 * 1024) { fail("Browser response too large"); child.kill(); return; }
     var at;
     while ((at = buffer.indexOf("\n")) >= 0) {
       var line = buffer.slice(0, at); buffer = buffer.slice(at + 1);
       try {
         var message = JSON.parse(line);
-        if (message.type === "result") {
+        if (message.type === "storage") {
+          try {
+            if (!options.storage) throw new Error("Personal site data is unavailable");
+            send({ type: "storage", id: message.id, storage: options.storage.exchange(message.previous, message.storage) });
+          } catch (error) { send({ type: "storage", id: message.id, error: "Could not save personal browser site data" }); }
+        } else if (message.type === "cookies") {
+          try {
+            if (!options.cookies) throw new Error("Personal cookies are unavailable");
+            var cookies = options.cookies.exchange(message.previous, message.cookies);
+            send({ type: "cookies", id: message.id, cookies: cookies });
+          } catch (error) { send({ type: "cookies", id: message.id, error: "Could not save personal browser cookies" }); }
+        } else if (message.type === "result") {
           var entry = pending.get(message.id);
           if (entry) { clearTimeout(entry.timer); pending.delete(message.id); if (message.error) entry.reject(new Error(message.error)); else entry.resolve(message.value); }
         } else options.onEvent(message);
@@ -45,8 +60,8 @@ function createRuntime(options) {
     }
   });
   child.on("error", function () { fail("Browser process could not start"); });
-  child.on("exit", function () { fail("Browser process ended"); });
-  send({ type: "start" });
+  child.on("exit", function () { fail("Browser process ended"); closed = true; });
+  send({ type: "start", cookies: initialCookies, storage: initialStorage });
   return {
     control: function (epoch) {
       return new Promise(function (resolve, reject) {
@@ -78,13 +93,14 @@ function createRuntime(options) {
       });
     },
     close: function () {
-      if (closed) return;
-      closed = true;
+      if (closed || closing) return exited;
+      closing = true;
       fail("Browser closed");
-      child.stdin.end();
-      var timer = setTimeout(function () { child.kill("SIGKILL"); }, 5000);
+      try { send({ type: "close" }); } catch (error) { child.stdin.end(); }
+      var timer = setTimeout(function () { child.kill("SIGKILL"); }, 30000);
       timer.unref();
       child.once("exit", function () { clearTimeout(timer); });
+      return exited;
     },
   };
 }

package/lib/shared-browser-storage-sync.js

@@ -0,0 +1,43 @@
+var cookieKey = require('./shared-browser-cookies').cookieKey;
+// Saved website data only crosses the private worker pipe, never the agent tool channel.
+function attachStorageSync(context, initial, send) {
+  var previous = initial, pending = null, nextId = 0;
+  function receive(message) {
+    if (!pending || pending.id !== message.id) return;
+    var entry = pending; pending = null; clearTimeout(entry.timer);
+    if (message.error) entry.reject(new Error(message.error)); else entry.resolve(message.storage);
+  }
+  async function sync() {
+    var current = await context.storageState({ indexedDB: true });
+    var saved = await new Promise(function (resolve, reject) {
+      pending = { id: ++nextId, resolve: resolve, reject: reject, timer: setTimeout(function () { pending = null; reject(new Error('Could not synchronize browser site data')); }, 10000) };
+      try { send({ type: 'storage', id: pending.id, previous: previous, storage: current }); }
+      catch (error) { clearTimeout(pending.timer); pending = null; reject(error); }
+    });
+    var remote = new Map(saved.cookies.map(function (cookie) { return [cookieKey(cookie), cookie]; }));
+    var local = new Map(current.cookies.map(function (cookie) { return [cookieKey(cookie), cookie]; }));
+    var updates = saved.cookies.filter(function (cookie) { return JSON.stringify(local.get(cookieKey(cookie))) !== JSON.stringify(cookie); });
+    current.cookies.forEach(function (cookie) { if (!remote.has(cookieKey(cookie))) updates.push(Object.assign({}, cookie, { expires: 1 })); });
+    if (updates.length) await context.addCookies(updates);
+    if (previous.generation !== saved.generation) {
+      var deletions = (saved.deletions || []).filter(function (entry) { return entry.generation > previous.generation; });
+      var unknown = !deletions.length || deletions[0].generation > previous.generation + 1;
+      var removed = current.origins.filter(function (origin) {
+        return unknown || deletions.some(function (entry) { return entry.operation === 'clear_data' || (entry.operation === 'delete_site' && new URL(origin.origin).hostname === entry.target); });
+      });
+      if (removed.length) {
+        var page = context.pages()[0] || await context.newPage();
+        var cdp = await context.newCDPSession(page);
+        try {
+          for (var origin of removed) await cdp.send('Storage.clearDataForOrigin', { origin: origin.origin, storageTypes: 'local_storage,indexeddb' });
+        } finally { await cdp.detach(); }
+      }
+      current = await context.storageState({ indexedDB: true });
+    }
+    // Restore origin storage on new tabs, rather than replacing live IndexedDB connections.
+    // Each open tab contributes only its own changes. Human removals also clear live origins.
+    previous = { generation: saved.generation, cookies: saved.cookies, origins: current.origins };
+  }
+  return { start: function () { return context.setStorageState({ cookies: initial.cookies, origins: initial.origins }); }, sync: sync, receive: receive };
+}
+module.exports = { attachStorageSync: attachStorageSync };