clay-server 5.2.0-beta.3 → 5.2.0-beta.5

package/lib/public/style.css

@@ -59,6 +59,7 @@
 @import url("css/home-debate-planning.css");
 @import url("css/home-mate-creation.css");
 @import url("css/home-mate-settings.css");
+@import url("css/mate-avatar-gallery.css");
 @import url("css/home-mate-model-picker.css");
 @import url("css/project-mate-creation.css");
 @import url("css/home-debate-live.css");
@@ -87,3 +88,5 @@
 @import url("css/server-settings-system.css");
 
 @import url("css/project-settings-modal.css");
+
+@import url("css/clay-tool-activity.css");

package/lib/public/sw.js

@@ -1,4 +1,4 @@
-var CACHE_NAME = "clay-offline-v4";
+var CACHE_NAME = "clay-offline-v5";
 
 self.addEventListener("install", function (event) {
   event.waitUntil(self.skipWaiting());
@@ -23,6 +23,8 @@ self.addEventListener("activate", function (event) {
 function shouldCache(request, response) {
   if (request.method !== "GET") return false;
   if (!response || !response.ok) return false;
+  var cacheControl = response.headers && response.headers.get("Cache-Control") || "";
+  if (/(^|,)\s*(private|no-store)(?:\s*=\s*[^,]*)?(?=\s*(?:,|$))/i.test(cacheControl)) return false;
   // Cache same-origin static assets and CDN resources (jsdelivr, fonts)
   var url = new URL(request.url);
   if (url.origin === self.location.origin) return true;

package/lib/scheduled-task-records.js

@@ -18,6 +18,7 @@ function createScheduledTaskRecords(ctx) {
     var runs = Array.isArray(record.runs) ? record.runs : [];
     var readiness = ctx.runtimeStatus ? ctx.runtimeStatus(record) : null;
     return {
+      createdBy: record.createdBy || null, updatedBy: record.updatedBy || null,
       id: record.id, revision: Number(record.updatedAt || 0), name: record.name || "",
       instructions: record.task || record.prompt || record.instructions || "",
       cron: record.cron || null, date: record.date || null, time: record.time || null,
@@ -49,7 +50,7 @@ function createScheduledTaskRecords(ctx) {
     return { ok: true, record: publicRecord(record) };
   }
 
-  function update(session, id, revision, patch) {
+  function update(session, id, revision, patch, actor) {
     if (typeof id !== "string" || !ID_PATTERN.test(id)) return { ok: false, error: "Scheduled task id is invalid." };
     var record = ctx.registry.getById(id);
     if (!record) return { ok: false, error: "Scheduled task not found." };
@@ -94,6 +95,7 @@ function createScheduledTaskRecords(ctx) {
     }
     try {
       var updateData = Object.assign({}, checked.value);
+      if (actor) updateData.updatedBy = actor;
       if (claimOwner) { updateData.ownerId = session.ownerId; updateData.enabled = true; }
       if (updateData.cron) {
         updateData.date = record.cron && !record.scheduleRule ? record.date || null : null;

package/lib/scheduler.js

@@ -239,6 +239,7 @@ function createLoopRegistry(opts) {
 
   function register(data) {
     var rec = {
+      createdBy: data.createdBy || null, updatedBy: data.updatedBy || null, creationFingerprint: data.creationFingerprint || null,
       id: data.id || ("loop_" + Date.now() + "_" + require("crypto").randomBytes(3).toString("hex")),
       name: data.name || "Untitled",
       task: data.task || "",
@@ -297,6 +298,7 @@ function createLoopRegistry(opts) {
     if (!rec) return null;
     var previous = Object.assign({}, rec);
 
+    if (data.updatedBy !== undefined) rec.updatedBy = data.updatedBy;
     if (data.name !== undefined) rec.name = data.name;
     if (data.cron !== undefined) rec.cron = data.cron;
     if (data.enabled !== undefined) rec.enabled = data.enabled;

package/lib/sdk-bridge.js

@@ -323,6 +323,7 @@ function createSDKBridge(opts) {
   }
 
   function stopIdleReaper() {
+    responseRecovery.dispose();
     if (_idleReaperTimer) {
       clearInterval(_idleReaperTimer);
       _idleReaperTimer = null;
@@ -389,6 +390,17 @@ function createSDKBridge(opts) {
   var sendAndRecord = msgProcessor.sendAndRecord;
   var sendToSession = msgProcessor.sendToSession;
 
+  var responseRecovery = require("./sdk-response-recovery").attachResponseRecovery(Object.assign({
+    sessions: sm.sessions,
+    changed: onProcessingChanged,
+    record: sendAndRecord,
+    send: sendToSession,
+    broadcast: function() { if (sm.broadcastSessionList) sm.broadcastSessionList(); },
+    restart: function(session, payload, state) {
+      return startQuery(session, payload.text, payload.images, payload.linuxUser, payload.beforePush, null, state);
+    },
+  }, opts.responseRecovery || {}));
+
   // --- MCP elicitation ---
 
   function handleElicitation(session, request, opts) {
@@ -417,6 +429,7 @@ function createSDKBridge(opts) {
 
       if (pushModule) {
         pushModule.sendPush({
+          sessionId: session.localId,
           type: "elicitation",
           slug: slug,
           title: (request.serverName || "MCP Server") + " needs input",
@@ -467,6 +480,7 @@ function createSDKBridge(opts) {
 
       if (pushModule) {
         pushModule.sendPush({
+          sessionId: session.localId,
           type: "user_dialog",
           slug: slug,
           title: "Claude needs a decision",
@@ -745,6 +759,34 @@ function createSDKBridge(opts) {
     // Workspace inspection and proposal posting are session-bound. Keep this
     // list exact so a future execution/mutation tool cannot inherit approval.
     var safeWorkspaceTools = {
+      "mcp__clay-workspace__read_owner_screen": true,
+      "mcp__clay-workspace__inspect_owner_screen_change": true,
+      "mcp__clay-workspace__control_owner_screen": true,
+      "mcp__clay-workspace__discover_product_controls": true,
+      "mcp__clay-workspace__list_owned_mates": true,
+      "mcp__clay-workspace__begin_schedule_control_interview": true,
+      "mcp__clay-workspace__read_schedule_controls": true,
+      "mcp__clay-workspace__inspect_schedule_change": true,
+      "mcp__clay-workspace__control_schedules": true,
+      "mcp__clay-workspace__read_mate_chat_control": true,
+      "mcp__clay-workspace__inspect_mate_chat_change": true,
+      "mcp__clay-workspace__control_mate_chat": true,
+      "mcp__clay-workspace__read_project_workspace": true,
+      "mcp__clay-workspace__read_workspace_receipt": true,
+      "mcp__clay-workspace__inspect_workspace_change": true,
+      "mcp__clay-workspace__control_project_workspace": true,
+      "mcp__clay-workspace__read_project_records": true,
+      "mcp__clay-workspace__inspect_project_record_change": true,
+      "mcp__clay-workspace__control_project_records": true,
+      "mcp__clay-workspace__read_mate_knowledge_control": true,
+      "mcp__clay-workspace__inspect_mate_knowledge_change": true,
+      "mcp__clay-workspace__control_mate_knowledge": true,
+      "mcp__clay-workspace__inspect_mate_control": true,
+      "mcp__clay-workspace__control_mate_lifecycle": true,
+      "mcp__clay-workspace__inspect_project_control": true,
+      "mcp__clay-workspace__control_project_lifecycle": true,
+      "mcp__clay-workspace__inspect_session_control": true,
+      "mcp__clay-workspace__control_project_session": true,
       "mcp__clay-workspace__list_projects": true,
       "mcp__clay-workspace__list_project_sessions": true,
       "mcp__clay-workspace__search_project_history": true,
@@ -902,6 +944,7 @@ function createSDKBridge(opts) {
 
       if (pushModule) {
         pushModule.sendPush({
+          sessionId: session.localId,
           type: "permission_request",
           slug: slug,
           requestId: requestId,
@@ -1006,6 +1049,7 @@ function createSDKBridge(opts) {
   function recordRuntimeEffectivePermissionMode(session, queryInstance, queryGeneration, message) {
     if (!message || (message.yokeType !== "init" && message.yokeType !== "status") || !message.permissionMode) return false;
     if (!ownsQueryRuntime(session, queryInstance, queryGeneration)) return false;
+    session._permissionObservationRevision = Number(session._permissionObservationRevision || 0) + 1;
     session.effectivePermissionMode = message.permissionMode;
     session.permissionModeFallbackReason = null;
     sm.saveSessionFile(session);
@@ -1047,7 +1091,7 @@ function createSDKBridge(opts) {
     try {
       for await (var msg of myQueryInstance) {
         // An old iterator may drain after Stop or after a replacement query starts.
-        if (!ownsQueryRuntime(session, myQueryInstance, myQueryGeneration)) continue;
+        if (!ownsQueryRuntime(session, myQueryInstance, myQueryGeneration) || responseRecovery.stopping(session)) continue;
         if ((session.taskStopRequested || (myAbortController && myAbortController.signal.aborted))
             && msg && msg.yokeType !== "error" && msg.yokeType !== "interrupted") continue;
         if (msg && msg.yokeType !== "text_delta" && msg.yokeType !== "thinking_delta" && msg.yokeType !== "tool_input_delta") {
@@ -1091,6 +1135,7 @@ function createSDKBridge(opts) {
         if (continuationIdentity && !ownsQueryRuntime(session, myQueryInstance, myQueryGeneration)) {
           continue;
         }
+        responseRecovery.event(session, msg);
         processSDKMessage(session, msg);
         if (continuationIdentity) {
           settleContinuationStartup(session, myQueryInstance, myQueryGeneration, true, null);
@@ -1120,7 +1165,7 @@ function createSDKBridge(opts) {
       // Stream ended normally after a task stop — no "result" message was sent,
       // so the session is still marked as processing. Send interrupted feedback.
       console.log("[sdk-bridge] processQueryStream ended: isProcessing=" + session.isProcessing + " taskStopRequested=" + session.taskStopRequested);
-      var stillOwnsRuntime = session.queryInstance === myQueryInstance;
+      var stillOwnsRuntime = session.queryInstance === myQueryInstance && !responseRecovery.stopping(session);
       settleContinuationStartup(session, myQueryInstance, myQueryGeneration, false, "The successor query ended before initialization.");
       if (session.isProcessing && session.taskStopRequested && stillOwnsRuntime) {
         session._lastTurnInterrupted = true;
@@ -1158,7 +1203,7 @@ function createSDKBridge(opts) {
       }
     } catch (err) {
       settleContinuationStartup(session, myQueryInstance, myQueryGeneration, false, err.message || "The successor query failed before initialization.");
-      if (session.isProcessing && session.queryInstance === myQueryInstance) {
+      if (session.isProcessing && session.queryInstance === myQueryInstance && !responseRecovery.stopping(session)) {
         session.isProcessing = false;
         session._awaitingTurnResult = false;
         session._queuedTurnCount = 0;
@@ -1272,7 +1317,8 @@ function createSDKBridge(opts) {
       }
       if (session.messageQueue === myMessageQueue) session.messageQueue = null;
       if (session.abortController === myAbortController) session.abortController = null;
-      if (ownsRuntime) {
+      if (ownsRuntime && !responseRecovery.stopping(session)) {
+        responseRecovery.cancel(session);
         session.taskStopRequested = false;
         session.pendingPermissions = {};
         // Preserve only restored legacy MCP entries. Canonical Yoke requests
@@ -1321,7 +1367,7 @@ function createSDKBridge(opts) {
           }
         }
       }
-      if (!session.isProcessing && typeof opts.onSessionAvailable === "function") opts.onSessionAvailable(session);
+      if (!responseRecovery.stopping(session) && !session.isProcessing && typeof opts.onSessionAvailable === "function") opts.onSessionAvailable(session);
     }
   }
 
@@ -1442,22 +1488,70 @@ function createSDKBridge(opts) {
 
   // Wrapper: marks the boot window so pushMessage can buffer instead of
   // dropping messages that arrive while createQuery is still awaiting.
-  async function startQuery(session, text, images, linuxUser, beforePush, onAccepted) {
+  async function startQuery(session, text, images, linuxUser, beforePush, onAccepted, retryState) {
+    if (opts.isLifecycleExecutionPaused && opts.isLifecycleExecutionPaused()) {
+      sendAndRecord(session, { type: "error", text: "Project execution is paused for lifecycle recovery. Reconcile the saved operation, or send a new owner message after restoring the registration." });
+      session.isProcessing = false; onProcessingChanged(); sendAndRecord(session, { type: "done", code: 1 }); return false;
+    }
+    if (session._responseRecoveryStopPending && !retryState) {
+      session.isProcessing = false;
+      onProcessingChanged();
+      sendAndRecord(session, { type: "error", text: "The previous Claude attempt has not confirmed stopped. Check the connection before sending this message again." });
+      sendAndRecord(session, { type: "done", code: 1 });
+      return false;
+    }
+    if (responseRecovery.stopping(session) && !retryState) return false;
     delete session._lastTurnInterrupted;
+    var claude = (session.vendor || adapter.vendor) === "claude";
+    var payload = { text: text, images: images, linuxUser: linuxUser, beforePush: beforePush };
+    var recoveryState = claude ? responseRecovery.begin(session, payload, retryState) : null;
+    if (recoveryState) recoveryState.handle = null;
+    var guardedPush = function() {
+      return !session.destroying && !session.taskStopRequested
+        && (!recoveryState || responseRecovery.valid(session, recoveryState) && !recoveryState.stopping)
+        && (typeof beforePush !== "function" || beforePush() === true);
+    };
+    guardedPush.exactProductDelivery = !!(beforePush && beforePush.exactProductDelivery);
     session._queryGeneration = (session._queryGeneration || 0) + 1;
     session._queryStarting = true;
+    var starting = startQueryInner(session, text, images, linuxUser, guardedPush, onAccepted, recoveryState);
+    if (recoveryState) recoveryState.starting = starting;
     try {
-      return await startQueryInner(session, text, images, linuxUser, beforePush, onAccepted);
+      var accepted = await starting;
+      if (accepted === false && (!recoveryState || !recoveryState.stopping)) {
+        responseRecovery.cancel(session);
+        session.isProcessing = false;
+        onProcessingChanged();
+      }
+      return accepted;
+    } catch (error) {
+      // Includes synchronous input queue failures, before stream consumption.
+      var failedHandle = session.queryInstance;
+      if (failedHandle) {
+        try { if (typeof failedHandle.abort === "function") failedHandle.abort(); } catch (e) {}
+        try { if (typeof failedHandle.close === "function") failedHandle.close(); } catch (e) {}
+      }
+      session.queryInstance = null;
+      session.abortController = null;
+      session.messageQueue = null;
+      session.isProcessing = false;
+      session._awaitingTurnResult = false;
+      session._queuedTurnCount = 0;
+      taskLifecycle.clearAll(session);
+      if (!recoveryState || !recoveryState.stopping) {
+        responseRecovery.cancel(session);
+        sendAndRecord(session, { type: "error", text: "The agent connection failed while delivering your message. Please retry or check the connection." });
+        sendAndRecord(session, { type: "done", code: 1 });
+        onProcessingChanged();
+        sm.broadcastSessionList();
+      }
+      return false;
     } finally {
       session._queryStarting = false;
-      if (!session.queryInstance && session.pendingPush && session.pendingPush.length) {
-        // The query never came up (auth/adapter failure already reported to
-        // the user). Drop the backlog rather than leaking it into a future
-        // unrelated query.
-        session.pendingPush = [];
-      }
-      if (!session.queryInstance && !session.isProcessing) session.taskStopRequested = false;
-      if (!session.isProcessing && typeof opts.onSessionAvailable === "function") opts.onSessionAvailable(session);
+      delete session._codexRecoveryWaiting;
+      if (!session.queryInstance && session.pendingPush && session.pendingPush.length) session.pendingPush = [];
+      if (!session.queryInstance && !session.isProcessing && !session._pendingMessageDrainPaused && !responseRecovery.stopping(session)) session.taskStopRequested = false;
+      if (!responseRecovery.stopping(session) && !session.isProcessing && typeof opts.onSessionAvailable === "function") opts.onSessionAvailable(session);
     }
   }
 
@@ -1501,7 +1595,7 @@ function createSDKBridge(opts) {
     };
   }
 
-  async function startQueryInner(session, text, images, linuxUser, beforePush, onAccepted) {
+  async function startQueryInner(session, text, images, linuxUser, beforePush, onAccepted, recoveryState) {
     var sessionRuntimeEnv = getRuntimeEnv(session);
     var resumedAtQueryStart = !!session.cliSessionId;
     async function ensureVendorReady(vendor) {
@@ -1812,7 +1906,7 @@ function createSDKBridge(opts) {
     }
     var hasSharedBrowserCatalog = sessionToolDefs.some(function (definition) { return definition.name === "shared_browser"; });
     var recoverCodexBrowserTools = sessionAdapter.vendor === "codex" && !!session.cliSessionId
-      && hasSharedBrowserCatalog && Number(session.codexSharedBrowserToolCatalogVersion || 0) < 5;
+      && hasSharedBrowserCatalog && Number(session.codexSharedBrowserToolCatalogVersion || 0) < 6;
     var recoverCodexIssueTools = sessionAdapter.vendor === "codex"
       && !!session.cliSessionId
       && hasIssueCatalog
@@ -1822,13 +1916,15 @@ function createSDKBridge(opts) {
       if (sm && sm.sessions && typeof sm.sessions.get === "function" && sm.sessions.get(session.localId) !== session) return false;
       return canUseSessionTools(session) === true;
     }
+    var hasMateScheduleTool = sessionToolDefs.some(function (tool) { return yoke.sessionTools.MATE_SCHEDULE_TOOLS.indexOf(tool.name) !== -1; });
+    var recoverCodexMateSchedules = sessionAdapter.vendor === "codex" && !!session.cliSessionId && hasMateScheduleTool && queryContextAvailable();
     var hasScheduleTool = false;
     var hasScheduleInterviewTool = false;
     var scheduleInterviewActive = null;
     var scheduleQuestionLimit = null;
     for (var sessionToolIndex = 0; sessionToolIndex < sessionToolDefs.length; sessionToolIndex++) {
       if (yoke.sessionTools.SCHEDULE_TOOLS.indexOf(sessionToolDefs[sessionToolIndex].name) !== -1) hasScheduleTool = true;
-      if (sessionToolDefs[sessionToolIndex].name === "begin_scheduled_task_interview") {
+      if (["begin_scheduled_task_interview", "begin_mate_schedule_interview", "begin_schedule_control_interview"].indexOf(sessionToolDefs[sessionToolIndex].name) >= 0) {
         hasScheduleInterviewTool = true;
         scheduleInterviewActive = sessionToolDefs[sessionToolIndex].scheduleInterviewActive || null;
         scheduleQuestionLimit = sessionToolDefs[sessionToolIndex].structuredQuestionLimit || null;
@@ -1860,9 +1956,10 @@ function createSDKBridge(opts) {
       return "Ask exactly one question at a time, wait for the answer, then ask the next question.";
     }
     var sessionUserInputHandler = function(request, respond) {
-      if (!structuredInputContextAvailable()) {
+      if (queryRetired() || !structuredInputContextAvailable()) {
         return respond.cancel("This structured-input request belongs to an unavailable or older query.");
       }
+      responseRecovery.progress(session);
       var questionError = scheduleQuestionError(request);
       if (questionError) return respond.cancel(questionError);
       if (request.presentation === "elicitation" && request.diagnostics && request.diagnostics.elicitation) {
@@ -1895,6 +1992,11 @@ function createSDKBridge(opts) {
         }
       }
     }
+    if (sessionAdapter.vendor === "claude" && hasMateScheduleTool && typeof sessionAdapter.createToolServer === "function") {
+      localMcpServers = Object.assign({}, localMcpServers || {});
+      localMcpServers["clay-mate-schedules"] = sessionAdapter.createToolServer({ name: "clay-mate-schedules", version: "1.0.0",
+        tools: sessionToolDefs.filter(function (tool) { return yoke.sessionTools.MATE_SCHEDULE_TOOLS.indexOf(tool.name) !== -1; }) });
+    }
     if (selectedUserInputMode === "fallback") {
       var userInputServer = yoke.userInput.createFallbackServer(sessionAdapter, sessionUserInputHandler, { force: true, maxQuestions: scheduleQuestionLimit });
       if (userInputServer) {
@@ -1931,6 +2033,12 @@ function createSDKBridge(opts) {
       return snapshotDef;
     }
 
+    var externalQueryBridge = require('./mcp-query-bridge').createQueryBridge({ valid: queryContextAvailable,
+      getServers: function () { return getRemoteMcpServers ? getRemoteMcpServers(session) || {} : {}; } });
+    var externalToolDefs = sessionAdapter.vendor === 'codex' ? externalQueryBridge.dynamicDefs() : [];
+    if (externalToolDefs.length) { sessionToolDefs = sessionToolDefs.concat(externalToolDefs); queryToolSnapshots.set(session, { generation: queryGeneration, defs: sessionToolDefs.slice() }); }
+    var recoverCodexExternalTools = sessionAdapter.vendor === 'codex' && !!session.cliSessionId && (externalToolDefs.length > 0 || isMate);
+
     // Give fresh queries an immediate provisional label. The visible user
     // message in history wins over `text`, which may contain an internal
     // provider wrapper rather than what the person typed.
@@ -1945,6 +2053,11 @@ function createSDKBridge(opts) {
     }
 
     var modelSwitchGeneration = session._queryGeneration;
+    function queryRetired() {
+      if (sessionAdapter.vendor !== "claude") return false;
+      return Number(session._sdkQueryGeneration || 0) !== queryGeneration || session.taskStopRequested
+        || session.destroying || responseRecovery.stopping(session) || (handle && session.queryInstance !== handle);
+    }
     var queryOpts = {
       onModelSwitch: function(change) {
         if (session._queryGeneration !== modelSwitchGeneration || session.taskStopRequested) return;
@@ -1986,7 +2099,18 @@ function createSDKBridge(opts) {
       dynamicTools: sessionToolDefs,
       // Codex persists dynamic tools with a thread. A stale authorized Driver
       // gets this exact-query bridge; its handlers still reauthorize live.
-      sessionMcpServer: (recoverCodexIssueTools || recoverCodexQuestionTools || recoverCodexBrowserTools || recoverCodexLinearTools || recoverCodexYouTools) ? getCodexSessionMcpServer(session, queryGeneration) : undefined,
+      sessionMcpServer: (recoverCodexMateSchedules || recoverCodexIssueTools || recoverCodexQuestionTools || recoverCodexBrowserTools || recoverCodexLinearTools || recoverCodexYouTools || recoverCodexExternalTools) ? getCodexSessionMcpServer(session, queryGeneration) : undefined,
+      onRecoveryAdmission: function(waiting) {
+        if (!queryContextAvailable()) return;
+        if (waiting) session._codexRecoveryWaiting = queryGeneration;
+        else delete session._codexRecoveryWaiting;
+      },
+      onRecoveryWaiting: function(waiting) {
+        if (!queryContextAvailable()) return;
+        sendAndRecord(session, { type: 'informational', level: 'info', content: waiting
+          ? 'Codex recovery is waiting for this conversation’s runtime to become safely available. Your message is retained; Stop cancels the wait.'
+          : 'Codex recovery is ready. Continuing your retained message.' });
+      },
       callDynamicTool: function (toolName, args) {
         var toolDef = findSessionToolDef(toolName);
         if (toolDef && typeof toolDef.handler === "function") {
@@ -1997,6 +2121,8 @@ function createSDKBridge(opts) {
       resumeSessionId: session.cliSessionId || undefined,
       abortController: linuxUser ? undefined : session.abortController,
       canUseTool: function(toolName, input, toolOpts) {
+        if (queryRetired()) return { behavior: "deny", message: "This attempt has stopped." };
+        responseRecovery.progress(session);
         var nativeQuestionError = toolName === "AskUserQuestion" ? scheduleQuestionError(input) : null;
         if (nativeQuestionError) return { behavior: "deny", message: nativeQuestionError };
         var permissionName = toolName;
@@ -2005,6 +2131,8 @@ function createSDKBridge(opts) {
         return handleCanUseTool(session, permissionName, input, toolOpts);
       },
       preToolUsePolicy: function(toolName, input) {
+        if (queryRetired()) return Promise.resolve({ behavior: "deny", message: "This attempt has stopped." });
+        responseRecovery.progress(session);
         var nativeQuestionError = toolName === "AskUserQuestion" ? scheduleQuestionError(input) : null;
         if (nativeQuestionError) return Promise.resolve({ behavior: "deny", message: nativeQuestionError });
         var permissionName = toolName;
@@ -2018,12 +2146,18 @@ function createSDKBridge(opts) {
       validateUserInputRequest: scheduleQuestionError,
       userInputMode: selectedUserInputMode,
       onElicitation: function(request, elicitOpts) {
+        if (queryRetired()) return Promise.resolve({ action: "cancel" });
+        responseRecovery.progress(session);
         return handleElicitation(session, request, elicitOpts);
       },
       onUserDialog: function(dialogRequest, dialogOpts) {
+        if (queryRetired()) return Promise.resolve({ behavior: "cancelled" });
+        responseRecovery.progress(session);
         return handleUserDialog(session, dialogRequest, dialogOpts);
       },
       callMcpTool: function(serverName, toolName, args) {
+        if (queryRetired()) return Promise.reject(new Error("This attempt has stopped."));
+        responseRecovery.progress(session);
         return callMcpToolHandler(mergedMcpServers, serverName, toolName, args);
       },
       adapterOptions: {
@@ -2055,10 +2189,28 @@ function createSDKBridge(opts) {
       },
     };
 
+    if (recoveryState) {
+      if (!recoveryState.context) recoveryState.context = { appendSystemPrompt: queryOpts.appendSystemPrompt, model: queryOpts.model, effort: queryOpts.effort };
+      Object.assign(queryOpts, recoveryState.context);
+    }
     var handle;
+    var startupHandle = session.queryInstance;
     console.log("[sdk-bridge] calling adapter.createQuery... vendor=" + sessionAdapter.vendor);
     try {
       handle = await sessionAdapter.createQuery(queryOpts);
+      // A guarded delivery must still own the exact startup after provider
+      // creation. Never replace a newer handle or publish to a deleted target.
+      if (beforePush && beforePush.exactProductDelivery) {
+        var startupCurrent = false;
+        try { startupCurrent = sm.sessions.get(session.localId) === session && session.queryInstance === startupHandle && Number(session._sdkQueryGeneration || 0) === queryGeneration && beforePush() === true; } catch (guardError) {}
+        if (!startupCurrent) {
+          try { if (handle.abort) handle.abort(); } catch (abortError) {}
+          try { if (handle.close) handle.close(); } catch (closeError) {}
+          if (session.queryInstance === startupHandle) session.isProcessing = false;
+          return false;
+        }
+      }
+      if (recoveryState) recoveryState.handle = handle;
       console.log("[sdk-bridge] createQuery returned handle, vendor=" + sessionAdapter.vendor);
       // SDK accepted the explicit title. Provisional labels remain eligible
       // for semantic generation after the first Home exchange (or the normal
@@ -2078,6 +2230,7 @@ function createSDKBridge(opts) {
       console.error("[sdk-bridge] Failed to create query for session " + session.localId + ":", e.message || e);
       console.error("[sdk-bridge] cliSessionId:", session.cliSessionId, "resume:", !!session.cliSessionId);
       console.error("[sdk-bridge] Stack:", e.stack || "(no stack)");
+      if (beforePush && beforePush.exactProductDelivery && (sm.sessions.get(session.localId) !== session || session.queryInstance !== startupHandle || Number(session._sdkQueryGeneration || 0) !== queryGeneration)) return false;
       session.isProcessing = false;
       session._awaitingTurnResult = false;
       session._queuedTurnCount = 0;
@@ -2132,6 +2285,7 @@ function createSDKBridge(opts) {
     }
 
     if (typeof beforePush === "function" && beforePush() !== true) {
+      try { if (typeof handle.abort === "function") handle.abort(); } catch (e) {}
       try { handle.close(); } catch (e) {}
       if (session.queryInstance === handle) session.queryInstance = null;
       session.messageQueue = null;
@@ -2141,6 +2295,13 @@ function createSDKBridge(opts) {
       session._queuedTurnCount = 0;
       taskLifecycle.clearAll(session);
       onProcessingChanged();
+      if (recoveryState && !responseRecovery.stopping(session)) {
+        sendAndRecord(session, { type: "thinking_stop" });
+        sendAndRecord(session, { type: session.taskStopRequested ? "info" : "error", text: session.taskStopRequested
+          ? "Stopped before sending your message."
+          : "This request is no longer eligible for delivery. Please review it and send it again." });
+        sendAndRecord(session, { type: "done", code: session.taskStopRequested ? 0 : 1 });
+      }
       sm.broadcastSessionList();
       return false;
     }
@@ -2208,7 +2369,7 @@ function createSDKBridge(opts) {
       if (hasYouCatalog) codexCatalogCandidate = Object.assign({}, codexCatalogCandidate || {}, { generation: queryGeneration, youVersion: 1 });
       if (hasLinearCatalog) codexCatalogCandidate = Object.assign({}, codexCatalogCandidate || {}, { generation: queryGeneration, linearVersion: 1 });
       if (hasSharedBrowserCatalog) {
-        codexCatalogCandidate = Object.assign({}, codexCatalogCandidate || {}, { generation: queryGeneration, sharedBrowserVersion: 5 });
+        codexCatalogCandidate = Object.assign({}, codexCatalogCandidate || {}, { generation: queryGeneration, sharedBrowserVersion: 6 });
       }
       if (hasIssueCatalog) {
         codexCatalogCandidate = Object.assign({}, codexCatalogCandidate || {}, {
@@ -2229,6 +2390,19 @@ function createSDKBridge(opts) {
   // dropped messages in both gap windows, which is what made a session show
   // the processing indicator without ever answering until a second send.
   function pushMessage(session, text, images, deliveryMeta) {
+    if (session._responseRecoveryStopPending && !responseRecovery.stopping(session)) return false;
+    function trackDelivery() {
+      if ((session.vendor || adapter.vendor) === "claude") responseRecovery.enqueue(session, {
+        text: text, images: images, linuxUser: session.lastLinuxUser || null,
+      });
+    }
+    if (responseRecovery.stopping(session)) {
+      // Keep admission serialized while the old execution is terminating.
+      session.pendingPush = session.pendingPush || [];
+      session.pendingPush.push(Object.assign({ text: text, images: images || null }, deliveryMeta || {}));
+      trackDelivery();
+      return true;
+    }
     session.lastActivityAt = Date.now();
     if (session._runtimeRefreshRequested && !session._queryStarting) {
       session._runtimeRefreshRequested = false;
@@ -2255,6 +2429,7 @@ function createSDKBridge(opts) {
         console.error("[sdk-bridge] QueryHandle rejected message for session " + session.localId + ":", e.message || e);
       }
       if (delivered) {
+        trackDelivery();
         delete session._lastTurnInterrupted;
         if (session._awaitingTurnResult) {
           session._queuedTurnCount = (session._queuedTurnCount || 0) + 1;
@@ -2279,6 +2454,7 @@ function createSDKBridge(opts) {
     if (session._queryStarting) {
       session.pendingPush = session.pendingPush || [];
       session.pendingPush.push(Object.assign({ text: text, images: images || null }, deliveryMeta || {}));
+      trackDelivery();
       return true;
     }
     return false;
@@ -2489,7 +2665,20 @@ function createSDKBridge(opts) {
     sendModelInfoForVendor(null, defaultVendor, defaultModelForVendor(defaultVendor));
   }
 
-  async function setModel(session, model) {
+  async function setModel(session, model, options) {
+    if (options && typeof options.revalidate === "function") {
+      var vendor = session.vendor || sm.defaultVendor || "claude";
+      return require("./session-config-transition").applySessionConfig({
+        sm: sm, session: session, revalidate: options.revalidate, method: "setModel", nativeValue: model, changes: { model: model },
+        publish: function () {
+          sm.defaultModelByVendor = sm.defaultModelByVendor || {};
+          sm.defaultModelByVendor[vendor] = model;
+          sm.broadcastSessionList();
+          sendModelInfoForVendor(session, vendor, model);
+          sendToSession(session, { type: "config_state", sessionId: session.localId, vendor: vendor, model: model, effort: session.effort || sm.currentEffort || "medium", mode: session.permissionMode || sm.currentPermissionMode || "default", betas: sm.currentBetas || [] });
+        },
+      });
+    }
     // Normalize to string id in case a { value, displayName } object slips in
     if (model && typeof model !== "string") {
       model = modelEntryValue(model);
@@ -2525,7 +2714,22 @@ function createSDKBridge(opts) {
     }
   }
 
-  async function setEffort(session, effort) {
+  async function setEffort(session, effort, options) {
+    if (options && typeof options.revalidate === "function") {
+      var vendor = session.vendor || sm.defaultVendor || "claude";
+      var value = yoke.clampEffort(vendor, effort);
+      if (!value || value !== effort) throw new Error("Unsupported reasoning effort.");
+      return require("./session-config-transition").applySessionConfig({
+        sm: sm, session: session, revalidate: options.revalidate, method: "setEffort", nativeValue: value, changes: { effort: value },
+        publish: function () {
+          sm.currentEffortByVendor = sm.currentEffortByVendor || {};
+          sm.currentEffortByVendor[vendor] = value;
+          sm.currentEffort = value;
+          sm.broadcastSessionList();
+          sendToSession(session, { type: "config_state", sessionId: session.localId, vendor: vendor, effort: value, model: session.model || "", mode: session.permissionMode || sm.currentPermissionMode || "default", betas: sm.currentBetas || [] });
+        },
+      });
+    }
     // Remember the pick per vendor (clamped) so vendor switches don't leak
     // unsupported levels across sessions; sm.currentEffort stays as the
     // display value for the session the user just configured.
@@ -2794,6 +2998,7 @@ function createSDKBridge(opts) {
     startQuery: startQuery,
     startQueryWithAcceptance: startQueryWithAcceptance,
     pushMessage: pushMessage,
+    cancelResponseRecovery: responseRecovery.cancel,
     refreshSessionRuntime: refreshSessionRuntime,
     refreshEnvironmentRuntime: refreshEnvironmentRuntime,
     setModel: setModel,

package/lib/sdk-message-processor.js

@@ -430,6 +430,7 @@ function attachMessageProcessor(ctx) {
         if (pushModule && block.name === "AskUserQuestion" && input.questions) {
           var q = input.questions[0];
           pushModule.sendPush({
+            sessionId: session.localId,
             type: "ask_user",
             slug: slug,
             title: (mateDisplayName || "Claude") + " has a question",
@@ -715,6 +716,7 @@ function attachMessageProcessor(ctx) {
 
       if (pushModule && !session._delegatedBy && !_suppressResponseNotification) {
         pushModule.sendPush({
+          sessionId: session.localId,
           type: "done",
           slug: slug,
           title: _doneTitle,