clay-server 5.2.0-beta.3 → 5.2.0-beta.5

package/lib/sdk-response-recovery.js

@@ -0,0 +1,155 @@
+// Claude delivery watchdog. Only an unanswered foreground turn is replayable.
+function attachResponseRecovery(ctx) {
+  var states = new Map();
+  var schedule = ctx.setTimeout || setTimeout;
+  var unschedule = ctx.clearTimeout || clearTimeout;
+  var waitMs = ctx.waitMs || 180000;
+  var stopMs = ctx.stopMs || 10000;
+
+  function live(session, state) {
+    return states.get(session) === state && !session.destroying && !session.taskStopRequested
+      && state.ownerId === session.ownerId && state.vendor === session.vendor
+      && (!ctx.sessions || ctx.sessions.get(session.localId) === session);
+  }
+  function clearTimer(state) {
+    if (state.timer) unschedule(state.timer);
+    state.timer = null;
+  }
+  function cancel(session, expected) {
+    var state = states.get(session);
+    if (expected && state !== expected) return;
+    if (state) clearTimer(state);
+    states.delete(session);
+  }
+  function protectedWait(session) {
+    return [session.pendingPermissions, session.pendingAskUser, session.pendingElicitations,
+      session.pendingUserDialogs, session.activeTaskToolIds].some(function(map) {
+      return map && Object.keys(map).length > 0;
+    }) || (session.activeBackgroundTasks && session.activeBackgroundTasks.length > 0);
+  }
+  function arm(session, state) {
+    clearTimer(state);
+    if (!state.turns.length || state.turns[0].progress || state.stopping) return;
+    state.timer = schedule(function() { expire(session, state); }, waitMs);
+    if (state.timer && state.timer.unref) state.timer.unref();
+  }
+  function snapshot(payload) {
+    return Object.assign({}, payload, { images: payload.images ? JSON.parse(JSON.stringify(payload.images)) : payload.images });
+  }
+  function begin(session, payload, retryState) {
+    if (retryState) return retryState;
+    cancel(session);
+    var state = { turns: [snapshot(payload)], timer: null, stopping: false, retried: false, ownerId: session.ownerId, vendor: session.vendor };
+    states.set(session, state);
+    arm(session, state);
+    return state;
+  }
+  function enqueue(session, payload) {
+    var state = states.get(session);
+    if (!state) return begin(session, payload);
+    state.turns.push(snapshot(payload));
+    return state;
+  }
+  function progress(session) {
+    var state = states.get(session);
+    if (!state || state.stopping || !state.turns.length) return;
+    state.turns[0].progress = true;
+    clearTimer(state);
+  }
+  function event(session, msg) {
+    var state = states.get(session);
+    if (!state || state.stopping || !msg) return;
+    var type = msg.yokeType;
+    if (type === 'error' || type === 'interrupted') { cancel(session); return; }
+    if (type === 'result') {
+      if (msg.subtype === 'success' && !msg.is_error && msg.numTurns === 0
+          && msg.origin && msg.origin.kind === 'task-notification'
+          && !msg.localCommand && msg.resultText === '') return;
+      var remaining = require('./sdk-turn-queue').pendingSends(session, msg);
+      state.turns = remaining ? state.turns.slice(-remaining) : [];
+      state.retried = false;
+      arm(session, state);
+      if (!state.turns.length) cancel(session);
+    } else if ((type === 'text_delta' || type === 'thinking_delta') && (msg.text || msg.delta)
+        || type === 'tool_start' || type === 'tool_input_delta' || type === 'tool_progress'
+        || type === 'task_started' || type === 'task_progress' || type === 'subagent_message'
+        || type === 'message' && msg.messageRole === 'assistant' && msg.content && msg.content.length) {
+      progress(session);
+    }
+  }
+  function finish(session, state, text) {
+    if (!live(session, state)) { cancel(session, state); return; }
+    cancel(session);
+    // Fence late output when a transport cannot confirm termination.
+    session._sdkQueryGeneration = Number(session._sdkQueryGeneration || 0) + 1;
+    session.isProcessing = false;
+    session._awaitingTurnResult = false;
+    session._queuedTurnCount = 0;
+    ctx.changed();
+    ctx.record(session, { type: 'thinking_stop' });
+    ctx.record(session, { type: 'error', text: text });
+    ctx.record(session, { type: 'done', code: 1 });
+    ctx.broadcast();
+  }
+  async function expire(session, state) {
+    clearTimer(state);
+    if (!live(session, state)) { cancel(session, state); return; }
+    // Never stop a known tool or a human decision because prose is absent.
+    if (protectedWait(session)) { progress(session); return; }
+    state.stopping = true;
+    ctx.record(session, { type: 'info', text: 'Claude has not responded for three minutes. Stopping this attempt safely before retrying.' });
+    var timeout;
+    var stopped = false;
+    try {
+      var stopAttempt = (async function() {
+        var handle = session.queryInstance || state.handle;
+        if (!handle && session.abortController) session.abortController.abort();
+        if (!handle && state.starting) await state.starting;
+        handle = handle || session.queryInstance || state.handle;
+        if (handle) {
+          if (typeof handle.stopAndWait !== 'function') return false;
+          await handle.stopAndWait();
+          if (session.streamPromise) await session.streamPromise;
+        }
+        return true;
+      })();
+      session._responseRecoveryStopPending = stopAttempt;
+      stopAttempt.then(function(confirmed) {
+        if (confirmed && session._responseRecoveryStopPending === stopAttempt) session._responseRecoveryStopPending = null;
+      }, function() {});
+      stopped = await Promise.race([
+        stopAttempt,
+        new Promise(function(resolve) { timeout = schedule(function() { resolve(false); }, stopMs); }),
+      ]);
+    } catch (e) { stopped = false; }
+    if (timeout) unschedule(timeout);
+    if (!live(session, state)) { cancel(session, state); return; }
+    if (!stopped) {
+      finish(session, state, 'Claude could not be confirmed stopped. Automatic retry was cancelled to avoid running your request twice. Check your Claude connection before trying again.');
+      return;
+    }
+    if (state.retried || state.turns.length !== 1) {
+      finish(session, state, state.retried
+        ? 'Claude still has not responded after one automatic retry. Please send your message again or check your Claude connection.'
+        : 'Claude did not respond. Several messages were queued, so automatic replay was cancelled to avoid duplicating work. Please send the unanswered messages again.');
+      return;
+    }
+    state.retried = true;
+    state.stopping = false;
+    session.isProcessing = true;
+    ctx.changed();
+    ctx.record(session, { type: 'info', text: 'The previous attempt has stopped. Retrying your original message once.' });
+    ctx.send(session, { type: 'status', status: 'processing' });
+    arm(session, state);
+    var payload = state.turns[0];
+    await ctx.restart(session, payload, state);
+  }
+  return {
+    begin: begin, enqueue: enqueue, event: event, progress: progress, cancel: cancel,
+    current: function(session) { return states.get(session); },
+    valid: live,
+    stopping: function(session) { var state = states.get(session); return !!(state && state.stopping); },
+    dispose: function() { states.forEach(function(state) { clearTimer(state); }); states.clear(); },
+  };
+}
+module.exports = { attachResponseRecovery: attachResponseRecovery };

package/lib/server-admin.js

@@ -18,6 +18,13 @@ function attachAdmin(ctx) {
   var onGetProjectAccess = ctx.onGetProjectAccess;
   var onProjectOwnerChanged = ctx.onProjectOwnerChanged;
 
+  function verifyCurrentOwner(req, route) {
+    if (!route || req.method === "GET" || !users.isMultiUser()) return;
+    var actor = getMultiUserFromReq(req);
+    var access = onGetProjectAccess && onGetProjectAccess(route[1]);
+    if (!actor || !access || access.ownerId !== actor.id || !users.findUserById(access.ownerId)) throw new Error("Project owner access required");
+  }
+
   function handleRequest(req, res, fullUrl) {
     var mateAccessRoute = /^\/api\/admin\/projects\/([^/]+)\/(visibility|owner|users|access)$/.exec(fullUrl);
     if (mateAccessRoute) {
@@ -31,6 +38,25 @@ function attachAdmin(ctx) {
     }
 
 
+    // Project content authority belongs to the valid owner, never the role.
+    if (mateAccessRoute && users.isMultiUser()) {
+      var actor = getMultiUserFromReq(req);
+      var governing = onGetProjectAccess && onGetProjectAccess(mateAccessRoute[1]);
+      var validOwner = governing && governing.ownerId && users.findUserById(governing.ownerId);
+      var owns = actor && validOwner && actor.id === validOwner.id;
+      if (req.method !== "GET" && !owns) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Only the valid project owner can change access." }));
+        return true;
+      }
+      if (req.method === "GET" && !owns && actor && actor.role === "admin") {
+        var overview = require("./project-admin-overview").metadataFor(actor, target && target.getStatus(), governing, users);
+        res.writeHead(overview ? 200 : 404, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(JSON.stringify(overview || { error: "Project not found" }));
+        return true;
+      }
+    }
+
     // --- Admin API endpoints (multi-user mode only) ---
 
     // List all users (admin only)
@@ -83,6 +109,16 @@ function attachAdmin(ctx) {
       // Look up the user before deletion to get linuxUser for deactivation
       var targetUser = users.findUserById(targetUserId);
       var targetLinuxUser = targetUser ? targetUser.linuxUser : null;
+      var owned = false;
+      projects.forEach(function (project, slug) {
+        var access = onGetProjectAccess && onGetProjectAccess(slug);
+        if (access && !access.isMate && access.ownerId === targetUserId) owned = true;
+      });
+      if (owned) {
+        res.writeHead(409, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "The owner must transfer ordinary projects before account deletion." }));
+        return true;
+      }
       var result = users.removeUser(targetUserId);
       if (result.error) {
         res.writeHead(404, { "Content-Type": "application/json" });
@@ -118,6 +154,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (!data.username || typeof data.username !== "string" || data.username.trim().length < 1) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Username is required"}');
@@ -182,6 +219,11 @@ function attachAdmin(ctx) {
         res.end('{"error":"User not found"}');
         return true;
       }
+      if (mu.id !== targetUserId) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Use account-owner credential recovery. Administrators cannot impersonate another account." }));
+        return true;
+      }
       var newPin = users.generatePin();
       var pinResult = users.updateUserPin(targetUserId, newPin);
       if (pinResult.error) {
@@ -222,15 +264,10 @@ function attachAdmin(ctx) {
       req.on("data", function(chunk) { body += chunk; });
       req.on("end", function() {
         try {
-          var parsed = JSON.parse(body);
-          var result = users.updateLinuxUser(targetUserId, parsed.linuxUser || null);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-          } else {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-          }
+          JSON.parse(body);
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "OS identity mapping requires server-side verified provisioning." }));
+          return;
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end('{"error":"Invalid request body"}');
@@ -363,6 +400,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Valid email is required"}');
@@ -429,6 +467,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           // Allow clearing SMTP config by sending empty fields
           if (!data.host && !data.user && !data.pass && !data.from) {
             smtp.saveSmtpConfig(null);
@@ -484,6 +523,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           // Use provided config or fall back to saved
           var existingCfg = smtp.getSmtpConfig();
           var pass = data.pass;
@@ -548,6 +588,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (data.visibility !== "public" && data.visibility !== "private") {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Visibility must be public or private"}');
@@ -582,9 +623,10 @@ function attachAdmin(ctx) {
         return true;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
+      var ownerAccess = onGetProjectAccess && onGetProjectAccess(fullUrl.split("/")[4]);
+      if (!mu || !ownerAccess || mu.id !== ownerAccess.ownerId) {
         res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+        res.end('{"error":"Project owner access required"}');
         return true;
       }
       var projSlug = fullUrl.split("/")[4];
@@ -598,17 +640,21 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           var targetCtx = projects.get(projSlug);
           if (!targetCtx) {
             res.writeHead(404, { "Content-Type": "application/json" });
             res.end('{"error":"Project not found"}');
             return;
           }
-          var ownerId = data.userId || null;
+          var ownerId = data.userId;
+          if (typeof ownerId !== "string" || !users.findUserById(ownerId)) throw new Error("A valid owner is required");
+          var currentAccess = onGetProjectAccess && onGetProjectAccess(projSlug);
+          if (!currentAccess || currentAccess.ownerId !== mu.id) throw new Error("Project owner access required");
+          if (!onProjectOwnerChanged) throw new Error("Ownership persistence is unavailable");
+          var saved = onProjectOwnerChanged(projSlug, ownerId);
+          if (saved && saved.error) throw new Error(saved.error);
           targetCtx.setProjectOwner(ownerId);
-          if (onProjectOwnerChanged) {
-            onProjectOwnerChanged(projSlug, ownerId);
-          }
           // Broadcast to project clients
           var ownerName = null;
           if (ownerId) {
@@ -653,7 +699,8 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
-          if (!Array.isArray(data.allowedUsers)) {
+          verifyCurrentOwner(req, mateAccessRoute);
+          if (!Array.isArray(data.allowedUsers) || data.allowedUsers.some(function (id) { return typeof id !== "string" || !users.findUserById(id); })) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"allowedUsers must be an array"}');
             return;

package/lib/server-appearance-settings.js

@@ -34,6 +34,18 @@ function attachAppearanceSettings(ctx) {
       fs.renameSync(defaultPath + '.tmp', defaultPath);
     }
   }
+  function getInitialAppearance(req) {
+    var user = identity(req);
+    if (!user) return null;
+    var saved = read(user);
+    return {
+      configured: saved.configured,
+      theme: saved.theme,
+      mode: saved.mode,
+      lightTheme: saved.lightTheme || null,
+      darkTheme: saved.darkTheme || null
+    };
+  }
   function handleRequest(req, res, url) {
     if (url !== '/api/user/appearance') return false;
     var user = identity(req);
@@ -66,6 +78,6 @@ function attachAppearanceSettings(ctx) {
     });
     return true;
   }
-  return { handleRequest: handleRequest };
+  return { handleRequest: handleRequest, getInitialAppearance: getInitialAppearance };
 }
 module.exports = { attachAppearanceSettings: attachAppearanceSettings };

package/lib/server-dm.js

@@ -49,7 +49,7 @@ function attachDm(ctx) {
       var mateCtx2 = mates.buildMateCtx(userId);
       if (mates.isMate(mateCtx2, msg.targetUserId)) {
         var mate = mates.getMate(mateCtx2, msg.targetUserId);
-        if (!mate) return true;
+        if (!mate || mate.lifecycleDeletion) return true;
         // Ensure mate project is registered (survives server restarts)
         var mateSlug2 = "mate-" + mate.id;
         if (!projects.has(mateSlug2)) {
@@ -69,6 +69,7 @@ function attachDm(ctx) {
             id: mate.id,
             displayName: mp.displayName || mate.name || "New Mate",
             username: mate.id,
+            avatarCatalogId: mp.avatarCatalogId || "",
             avatarStyle: mp.avatarStyle || "imprint",
             avatarSeed: mp.avatarSeed || mate.id,
             avatarColor: mp.avatarColor || "#5857fc",

package/lib/server-global-ws.js

@@ -63,14 +63,6 @@ function attachGlobalWs(opts) {
     if (msg.type === "browse_dir") {
       var rawPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
       var absTarget = path.resolve(rawPath);
-      // Multi-user mode: non-admins can only browse their home directory.
-      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
-        var browseHome = ws._clayUser.linuxUser ? "/home/" + ws._clayUser.linuxUser : null;
-        if (!browseHome || (absTarget !== browseHome && (absTarget + "/").indexOf(browseHome + "/") !== 0)) {
-          sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: [], error: "Access restricted to your home directory" });
-          return;
-        }
-      }
       var parentDir, prefix;
       try {
         var stat = fs.statSync(absTarget);
@@ -87,12 +79,17 @@ function attachGlobalWs(opts) {
         parentDir = path.dirname(absTarget);
         prefix = path.basename(absTarget).toLowerCase();
       }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, parentDir)) {
+        sendTo(ws, { type: "browse_dir_result", entries: [], error: "Directory access is not permitted" });
+        return;
+      }
       try {
         var dirItems = fs.readdirSync(parentDir, { withFileTypes: true });
         var dirEntries = [];
         for (var di = 0; di < dirItems.length; di++) {
           var d = dirItems[di];
           if (!d.isDirectory()) continue;
+          if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, path.join(parentDir, d.name))) continue;
           if (d.name.charAt(0) === ".") continue;
           if (IGNORED_DIRS.has(d.name)) continue;
           if (prefix && !d.name.toLowerCase().startsWith(prefix)) continue;
@@ -110,16 +107,9 @@ function attachGlobalWs(opts) {
     if (msg.type === "add_project") {
       var addPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
       var addAbs = path.resolve(addPath);
-      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
-        if (!ws._clayUser.linuxUser) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "No Linux user assigned" });
-          return;
-        }
-        var userHome = "/home/" + ws._clayUser.linuxUser;
-        if (addAbs !== userHome && (addAbs + "/").indexOf(userHome + "/") !== 0) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "Path not allowed. You can only add directories under " + userHome });
-          return;
-        }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, addAbs)) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Directory access is not permitted" });
+        return;
       }
       try {
         var addStat = fs.statSync(addAbs);
@@ -133,7 +123,7 @@ function attachGlobalWs(opts) {
       }
       if (typeof onAddProject === "function") {
         var result = onAddProject(addAbs, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: result.ok, slug: result.slug, error: result.error, existing: result.existing });
+        sendTo(ws, Object.assign({}, result, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }
@@ -159,7 +149,7 @@ function attachGlobalWs(opts) {
       }
       if (typeof onCreateProject === "function") {
         var createResult = onCreateProject(createName, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: createResult.ok, slug: createResult.slug, error: createResult.error });
+        sendTo(ws, Object.assign({}, createResult, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }

package/lib/server-home-chat-events.js

@@ -3,7 +3,7 @@
 function homeDebateQuestions(input) {
   var source = input && Array.isArray(input.questions) && input.questions[0] ? input.questions[0] : null;
   if (!source) return [];
-  var question = { header: source.header || "", question: source.question || "", multiSelect: false, options: [] };
+  var question = { header: source.header || "", question: source.question || "", multiSelect: false, allowOther: source.allowOther !== false, options: [] };
   var options = Array.isArray(source.options) ? source.options.slice(0, 6) : [];
   for (var i = 0; i < options.length; i++) question.options.push({ label: options[i].label || "Option", description: options[i].description || "" });
   return [question];
@@ -36,6 +36,7 @@ function findDebateTurn(messages, event) {
 function debateIdentity(source, fallback) {
   var prior = fallback || {};
   return {
+    avatarCatalogId: source.avatarCatalogId || prior.avatarCatalogId || "",
     avatarStyle: source.avatarStyle || prior.avatarStyle || "imprint",
     avatarSeed: source.avatarSeed || prior.avatarSeed || source.mateId || "mate",
     avatarColor: source.avatarColor || prior.avatarColor || "",
@@ -112,7 +113,7 @@ function applyAssignmentHistoryEvent(messages, event) {
   messages.push({ role: "assignment", assignment: assignment });
 }
 
-function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
+function historyToHomeChat(history, debateSetupMode, mateCreationMode, pendingAskUser) {
   var messages = [];
   var pending = "";
   var interviewMode = debateSetupMode === true || mateCreationMode === true;
@@ -124,6 +125,12 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
   for (var i = 0; i < history.length; i++) {
     var event = history[i];
     if (!event) continue;
+    if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && ['mcp-import', 'mate-schedule', 'mcp_fallback', 'product-control'].indexOf(event.source) >= 0) {
+      flushAssistant();
+      var activeConsent = pendingAskUser === undefined || !!(pendingAskUser && pendingAskUser[event.id]);
+      messages.push({ role: 'question', flow: event.source === 'mcp-import' ? 'mcp_import' : 'mate_question', toolId: event.id, questions: homeDebateQuestions(event.input), status: activeConsent ? 'pending' : 'expired', error: activeConsent ? '' : 'This question is no longer active. Ask for a new review.' });
+      continue;
+    }
     if (event.type === "project_assignment_proposal" || event.type === "project_assignment_status") {
       flushAssistant();
       applyAssignmentHistoryEvent(messages, event);
@@ -185,7 +192,7 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
     } else if (interviewMode && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) {
       flushAssistant();
       messages.push({ role: "question", flow: mateCreationMode === true ? "mate_creation" : "debate", toolId: event.id, questions: homeDebateQuestions(event.input), status: "pending", error: "" });
-    } else if ((event.type === "ask_user_answered" || event.type === "home_debate_question_expired" || event.type === "home_mate_creation_question_expired") && event.toolId) {
+    } else if ((event.type === "ask_user_answered" || event.type === "home_debate_question_expired" || event.type === "home_mate_creation_question_expired" || event.type === "mcp_import_consent_expired" || event.type === "mate_schedule_question_expired") && event.toolId) {
       for (var k = messages.length - 1; k >= 0; k--) {
         if (messages[k].role === "question" && messages[k].toolId === event.toolId) {
           messages[k].status = event.type === "ask_user_answered" ? "answered" : "expired";
@@ -273,7 +280,7 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
   }
   if (session && session.homeDebatePlanning === true && HOME_DEBATE_EVENT_TYPES[event.type]) {
     var live = { type: "home_debate_event", eventType: event.type };
-    var fields = ["turnId", "decisionId", "decision", "toolName", "command", "commandTruncated", "topic", "format", "moderatorId", "moderatorName", "panelists", "mateName", "role", "round", "activity", "delta", "text", "reason", "action", "avatarStyle", "avatarSeed", "avatarColor", "avatarCustom"];
+    var fields = ["turnId", "decisionId", "decision", "toolName", "command", "commandTruncated", "topic", "format", "moderatorId", "moderatorName", "panelists", "mateName", "role", "round", "activity", "delta", "text", "reason", "action", "avatarCatalogId", "avatarStyle", "avatarSeed", "avatarColor", "avatarCustom"];
     for (var fi = 0; fi < fields.length; fi++) if (Object.prototype.hasOwnProperty.call(event, fields[fi])) live[fields[fi]] = event[fields[fi]];
     if (event.mateId) live.speakerMateId = event.mateId;
     return Object.assign(live, metadata);
@@ -298,6 +305,13 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
   if (event.type === "debate_proposal_resolved" && event.proposalId) return Object.assign({ type: "home_debate_proposal_resolved", proposalId: event.proposalId, action: event.action || "cancel", error: event.error || "" }, metadata);
   if (session && session.mateCreationMode === true && event.type === "mate_creation_proposal" && event.proposal) return Object.assign({ type: "home_mate_creation_proposal", proposal: event.proposal }, metadata);
   if (session && session.mateCreationMode === true && event.type === "mate_creation_proposal_resolved" && event.proposalId) return Object.assign({ type: "home_mate_creation_proposal_resolved", proposalId: event.proposalId, action: event.action || "cancel", createdMateId: event.mateId || null, mateName: event.mateName || null, error: event.error || "" }, metadata);
+  if (!(session && (session.debateSetupMode === true || session.mateCreationMode === true)) && event.type === 'tool_executing' && event.name === 'AskUserQuestion' && ['mate-schedule', 'mcp_fallback', 'product-control'].indexOf(event.source) >= 0) return Object.assign({ type: 'home_mate_question', toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
+  if (session && session.debateSetupMode !== true && session.mateCreationMode !== true && event.type === 'ask_user_answered' && event.toolId && (session.history || []).some(function (item) { return item.id === event.toolId && ['mate-schedule', 'mcp_fallback', 'product-control'].indexOf(item.source) >= 0; })) return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'answered', answers: event.answers }, metadata);
+  if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && event.source === 'mcp-import') return Object.assign({ type: 'home_mcp_import_question', toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
+  if (event.type === 'product_control_question_expired') return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (event.type === 'mate_schedule_question_expired') return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (event.type === 'mcp_import_consent_expired') return Object.assign({ type: 'home_mcp_import_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (session && event.type === 'ask_user_answered' && event.toolId && (session.history || []).some(function (item) { return item.id === event.toolId && item.source === 'mcp-import'; })) return Object.assign({ type: 'home_mcp_import_question_resolved', toolId: event.toolId, status: 'answered', answers: event.answers }, metadata);
   if (session && session.debateSetupMode === true && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) {
     return Object.assign({ type: "home_debate_question", toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
   }

package/lib/server-home-chat.js

@@ -31,7 +31,7 @@ function attachHomeChat(deps) {
       }
       if (!mateId && allMates[i].builtinKey === "clay") mate = allMates[i];
     }
-    if (!mate) return null;
+    if (!mate || mate.lifecycleDeletion) return null;
     var slug = "mate-" + mate.id;
     if (!projects.has(slug)) {
       if (!ensureRegistered) return null;
@@ -184,6 +184,12 @@ function attachHomeChat(deps) {
       }
     });
     if (!unsubscribe) return;
+    var unregisterConsent = null;
+    if (openedSession && typeof found.ctx.registerMcpConsentViewer === 'function') {
+      try { unregisterConsent = found.ctx.registerMcpConsentViewer(ws, openedSession); } catch (error) {}
+    }
+    var unsubscribeEvents = unsubscribe;
+    unsubscribe = function () { if (unregisterConsent) unregisterConsent(); unsubscribeEvents(); };
     ws[tapKey] = {
       unsubscribe: unsubscribe,
       sessionId: sessionId,
@@ -238,7 +244,7 @@ function attachHomeChat(deps) {
         requestId: requestId || null,
         model: session.model || null,
         vendor: session.vendor || null,
-        messages: historyToHomeChat(session.history || [], session.debateSetupMode === true, session.mateCreationMode === true),
+        messages: historyToHomeChat(session.history || [], session.debateSetupMode === true, session.mateCreationMode === true, session.pendingAskUser),
         isProcessing: session.isProcessing === true,
       };
       if (session.homeClayEntryMode === "search") {
@@ -293,6 +299,7 @@ function attachHomeChat(deps) {
     homeModels: homeModels, isActorLive: isActorLive, persistActiveSession: persistActiveSession,
   });
   var homeMateCreation = attachHomeMateCreation({ findMateProject: findMateProject, resolveHomeSession: resolveHomeSession, sessionReference: sessionReference, setupTap: setupTap, sendHistory: sendHistory, sendSessionList: sendSessionList, sendError: sendError, sendModelError: sendModelError, homeModels: homeModels, isActorLive: isActorLive, persistActiveSession: persistActiveSession });
+  var homeMcpConsent = require('./server-home-mcp-consent').attachHomeMcpConsent({ findMateProject: findMateProject, resolveHomeSession: resolveHomeSession, messageTap: messageTap, isActorLive: isActorLive, sendError: sendError });
   var homeClayEntry = attachHomeClayEntry({ findMateProject: findMateProject, ownsSession: ownsSession, sessionReference: sessionReference, setupSearchTap: setupSearchTap, sendHistory: sendHistory, sendSessionList: sendSessionList, sendError: sendError, sendModelError: sendModelError, homeModels: homeModels, isActorLive: isActorLive });
 
   async function openExactSession(ws, found, userId, selected, msg) {
@@ -397,20 +404,8 @@ function attachHomeChat(deps) {
       historyError.sessionId = sessionReference(activeSession);
       throw historyError;
     }
-    sessionManager.sendAndRecord(activeSession, { type: "user_message", text: text });
     try {
-      if (!activeSession.isProcessing) {
-        activeSession.isProcessing = true;
-        activeSession.sentToolResults = {};
-        if (typeof options.onRecorded === "function") options.onRecorded(activeSession);
-        if (!activeSession.queryInstance && (!activeSession.worker || activeSession.messageQueue !== "worker")) {
-          sdk.startQuery(activeSession, options.queryText || text, null, null);
-        } else {
-          sdk.pushMessage(activeSession, options.queryText || text, null);
-        }
-      } else {
-        sdk.pushMessage(activeSession, options.queryText || text, null);
-      }
+      await require('./mate-message-delivery').deliver({ sm: sessionManager, sdk: sdk }, activeSession, text, options);
     } catch (error) {
       error.sessionId = sessionReference(activeSession);
       throw error;
@@ -449,7 +444,7 @@ function attachHomeChat(deps) {
       }
       return true;
     }
-    if (msg.type !== "issue_reference_resolve" && msg.type !== "home_debates_list" && msg.type !== "home_clay_ask" && msg.type !== "home_clay_session_resolve" && msg.type !== "home_clay_log_resolve" && msg.type !== "home_mate_present" && msg.type !== "home_mate_open" && msg.type !== "home_mate_sessions_list" && msg.type !== "home_mate_session_open" && msg.type !== "home_mate_send" && msg.type !== "home_mate_new_session" && msg.type !== "home_mate_debate_plan" && msg.type !== "home_debate_proposal_response" && msg.type !== "home_debate_question_response" && msg.type !== "home_debate_control" && msg.type !== "home_mate_creation_plan" && msg.type !== "home_mate_creation_question_response" && msg.type !== "home_mate_creation_proposal_response" && msg.type !== "home_mate_close" && msg.type !== "home_mate_memory_list" && msg.type !== "home_mate_knowledge_list" && msg.type !== "home_mate_models_get" && msg.type !== "home_mate_model_set") {
+    if (msg.type !== "issue_reference_resolve" && msg.type !== "home_debates_list" && msg.type !== "home_clay_ask" && msg.type !== "home_clay_session_resolve" && msg.type !== "home_clay_log_resolve" && msg.type !== "home_mate_present" && msg.type !== "home_mate_open" && msg.type !== "home_mate_sessions_list" && msg.type !== "home_mate_session_open" && msg.type !== "home_mate_send" && msg.type !== "home_mate_new_session" && msg.type !== "home_mate_debate_plan" && msg.type !== "home_debate_proposal_response" && msg.type !== "home_mcp_import_response" && msg.type !== "home_mate_question_response" && msg.type !== "home_debate_question_response" && msg.type !== "home_debate_control" && msg.type !== "home_mate_creation_plan" && msg.type !== "home_mate_creation_question_response" && msg.type !== "home_mate_creation_proposal_response" && msg.type !== "home_mate_close" && msg.type !== "home_mate_memory_list" && msg.type !== "home_mate_knowledge_list" && msg.type !== "home_mate_models_get" && msg.type !== "home_mate_model_set") {
       return false;
     }
 
@@ -474,6 +469,7 @@ function attachHomeChat(deps) {
       return true;
     }
 
+    if (msg.type === "home_mcp_import_response" || msg.type === "home_mate_question_response") { homeMcpConsent.respond(ws, userId, msg); return true; }
     if (msg.type === "issue_reference_resolve") { resolveIssueLink(ws, msg); return true; }
     if (homeDebates.handle(ws, userId, msg)) return true;
     if (msg.type === "home_clay_ask") { homeClayEntry.start(ws, userId, msg); return true; }

package/lib/server-home-mate-creation.js

@@ -18,6 +18,7 @@ var INITIATION_PROMPT = [
   "Before the user answers again, your first and only action must be the next most useful AskUserQuestion. Before presenting it, do not use Bash, Read, Glob, Grep, workspace history, general knowledge, or any other inspection tool, and do not add a preface.",
   "When that tool returns the user's answer, continue the interview normally. Inspect only bounded context that is directly relevant to what the user supplied, and do not bulk-read knowledge files.",
   "Then explore the working relationship, recurring activities and context, communication preferences, autonomy, boundaries, and escalation behavior. Use grounded choices only when helpful. Every three to five exchanges, briefly summarize what you understand inside the next question and let the user correct it.",
+  "If the user explicitly asks the future Mate to send a scheduled message, collect the message and exact local date/time, timezone, and repetition only through one focused structured question at a time. Treat it as optional schedule intent: never create or register a job during this interview; include it only in propose_mate after reviewing it with the user.",
   "Choose the Mate's name last. Do not write files and do not create or update a Mate directly.",
   "When the identity is complete, end only by calling propose_mate with a concise public bio, structured preferences, and a complete first-person identityMarkdown. Do not emit a normal assistant preface or conclusion.",
 ].join("\n");

package/lib/server-home-mcp-consent.js

@@ -0,0 +1,14 @@
+// Home transcript responses retain the project's server-owned consent request.
+function attachHomeMcpConsent(ctx) {
+  function respond(ws, userId, msg) {
+    var found = ctx.findMateProject(userId, msg.mateId || null, false);
+    var session = found && ctx.resolveHomeSession(found, userId, msg.sessionId);
+    var tap = ctx.messageTap(ws, msg), pending = session && session.pendingAskUser && session.pendingAskUser[msg.toolId];
+    if (!ctx.isActorLive(ws, userId) || !found || !session || !tap || tap.mateSlug !== found.slug || tap.sessionId !== session.localId || (tap.requestId || null) !== (msg.requestId || null) || !pending || !pending.request || ['mcp-import', 'mate-schedule', 'mcp_fallback', 'product-control'].indexOf(pending.request.source) < 0) {
+      ctx.sendError(ws, found && found.mate.id, 'This owner question is unavailable or expired.', msg.requestId || null, msg.sessionId || null, 'question_expired', { toolId: msg.toolId }); return;
+    }
+    if (!found.ctx.handleHomeAskUserResponse({ type: 'ask_user_response', toolId: msg.toolId, answers: msg.answers || {} }, session, ws)) ctx.sendError(ws, found.mate.id, 'This question could not be submitted.', msg.requestId || null, msg.sessionId, 'question_refused', { toolId: msg.toolId });
+  }
+  return { respond: respond };
+}
+module.exports = { attachHomeMcpConsent: attachHomeMcpConsent };