clay-server 5.2.0-beta.4 → 5.2.0-beta.5

package/lib/server-admin.js

@@ -18,6 +18,13 @@ function attachAdmin(ctx) {
   var onGetProjectAccess = ctx.onGetProjectAccess;
   var onProjectOwnerChanged = ctx.onProjectOwnerChanged;
 
+  function verifyCurrentOwner(req, route) {
+    if (!route || req.method === "GET" || !users.isMultiUser()) return;
+    var actor = getMultiUserFromReq(req);
+    var access = onGetProjectAccess && onGetProjectAccess(route[1]);
+    if (!actor || !access || access.ownerId !== actor.id || !users.findUserById(access.ownerId)) throw new Error("Project owner access required");
+  }
+
   function handleRequest(req, res, fullUrl) {
     var mateAccessRoute = /^\/api\/admin\/projects\/([^/]+)\/(visibility|owner|users|access)$/.exec(fullUrl);
     if (mateAccessRoute) {
@@ -31,6 +38,25 @@ function attachAdmin(ctx) {
     }
 
 
+    // Project content authority belongs to the valid owner, never the role.
+    if (mateAccessRoute && users.isMultiUser()) {
+      var actor = getMultiUserFromReq(req);
+      var governing = onGetProjectAccess && onGetProjectAccess(mateAccessRoute[1]);
+      var validOwner = governing && governing.ownerId && users.findUserById(governing.ownerId);
+      var owns = actor && validOwner && actor.id === validOwner.id;
+      if (req.method !== "GET" && !owns) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Only the valid project owner can change access." }));
+        return true;
+      }
+      if (req.method === "GET" && !owns && actor && actor.role === "admin") {
+        var overview = require("./project-admin-overview").metadataFor(actor, target && target.getStatus(), governing, users);
+        res.writeHead(overview ? 200 : 404, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(JSON.stringify(overview || { error: "Project not found" }));
+        return true;
+      }
+    }
+
     // --- Admin API endpoints (multi-user mode only) ---
 
     // List all users (admin only)
@@ -83,6 +109,16 @@ function attachAdmin(ctx) {
       // Look up the user before deletion to get linuxUser for deactivation
       var targetUser = users.findUserById(targetUserId);
       var targetLinuxUser = targetUser ? targetUser.linuxUser : null;
+      var owned = false;
+      projects.forEach(function (project, slug) {
+        var access = onGetProjectAccess && onGetProjectAccess(slug);
+        if (access && !access.isMate && access.ownerId === targetUserId) owned = true;
+      });
+      if (owned) {
+        res.writeHead(409, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "The owner must transfer ordinary projects before account deletion." }));
+        return true;
+      }
       var result = users.removeUser(targetUserId);
       if (result.error) {
         res.writeHead(404, { "Content-Type": "application/json" });
@@ -118,6 +154,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (!data.username || typeof data.username !== "string" || data.username.trim().length < 1) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Username is required"}');
@@ -182,6 +219,11 @@ function attachAdmin(ctx) {
         res.end('{"error":"User not found"}');
         return true;
       }
+      if (mu.id !== targetUserId) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "Use account-owner credential recovery. Administrators cannot impersonate another account." }));
+        return true;
+      }
       var newPin = users.generatePin();
       var pinResult = users.updateUserPin(targetUserId, newPin);
       if (pinResult.error) {
@@ -222,15 +264,10 @@ function attachAdmin(ctx) {
       req.on("data", function(chunk) { body += chunk; });
       req.on("end", function() {
         try {
-          var parsed = JSON.parse(body);
-          var result = users.updateLinuxUser(targetUserId, parsed.linuxUser || null);
-          if (result.error) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: result.error }));
-          } else {
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end('{"ok":true}');
-          }
+          JSON.parse(body);
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "OS identity mapping requires server-side verified provisioning." }));
+          return;
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end('{"error":"Invalid request body"}');
@@ -363,6 +400,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Valid email is required"}');
@@ -429,6 +467,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           // Allow clearing SMTP config by sending empty fields
           if (!data.host && !data.user && !data.pass && !data.from) {
             smtp.saveSmtpConfig(null);
@@ -484,6 +523,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           // Use provided config or fall back to saved
           var existingCfg = smtp.getSmtpConfig();
           var pass = data.pass;
@@ -548,6 +588,7 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           if (data.visibility !== "public" && data.visibility !== "private") {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"Visibility must be public or private"}');
@@ -582,9 +623,10 @@ function attachAdmin(ctx) {
         return true;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
+      var ownerAccess = onGetProjectAccess && onGetProjectAccess(fullUrl.split("/")[4]);
+      if (!mu || !ownerAccess || mu.id !== ownerAccess.ownerId) {
         res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+        res.end('{"error":"Project owner access required"}');
         return true;
       }
       var projSlug = fullUrl.split("/")[4];
@@ -598,17 +640,21 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          verifyCurrentOwner(req, mateAccessRoute);
           var targetCtx = projects.get(projSlug);
           if (!targetCtx) {
             res.writeHead(404, { "Content-Type": "application/json" });
             res.end('{"error":"Project not found"}');
             return;
           }
-          var ownerId = data.userId || null;
+          var ownerId = data.userId;
+          if (typeof ownerId !== "string" || !users.findUserById(ownerId)) throw new Error("A valid owner is required");
+          var currentAccess = onGetProjectAccess && onGetProjectAccess(projSlug);
+          if (!currentAccess || currentAccess.ownerId !== mu.id) throw new Error("Project owner access required");
+          if (!onProjectOwnerChanged) throw new Error("Ownership persistence is unavailable");
+          var saved = onProjectOwnerChanged(projSlug, ownerId);
+          if (saved && saved.error) throw new Error(saved.error);
           targetCtx.setProjectOwner(ownerId);
-          if (onProjectOwnerChanged) {
-            onProjectOwnerChanged(projSlug, ownerId);
-          }
           // Broadcast to project clients
           var ownerName = null;
           if (ownerId) {
@@ -653,7 +699,8 @@ function attachAdmin(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
-          if (!Array.isArray(data.allowedUsers)) {
+          verifyCurrentOwner(req, mateAccessRoute);
+          if (!Array.isArray(data.allowedUsers) || data.allowedUsers.some(function (id) { return typeof id !== "string" || !users.findUserById(id); })) {
             res.writeHead(400, { "Content-Type": "application/json" });
             res.end('{"error":"allowedUsers must be an array"}');
             return;

package/lib/server-dm.js

@@ -49,7 +49,7 @@ function attachDm(ctx) {
       var mateCtx2 = mates.buildMateCtx(userId);
       if (mates.isMate(mateCtx2, msg.targetUserId)) {
         var mate = mates.getMate(mateCtx2, msg.targetUserId);
-        if (!mate) return true;
+        if (!mate || mate.lifecycleDeletion) return true;
         // Ensure mate project is registered (survives server restarts)
         var mateSlug2 = "mate-" + mate.id;
         if (!projects.has(mateSlug2)) {

package/lib/server-global-ws.js

@@ -63,14 +63,6 @@ function attachGlobalWs(opts) {
     if (msg.type === "browse_dir") {
       var rawPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
       var absTarget = path.resolve(rawPath);
-      // Multi-user mode: non-admins can only browse their home directory.
-      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
-        var browseHome = ws._clayUser.linuxUser ? "/home/" + ws._clayUser.linuxUser : null;
-        if (!browseHome || (absTarget !== browseHome && (absTarget + "/").indexOf(browseHome + "/") !== 0)) {
-          sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: [], error: "Access restricted to your home directory" });
-          return;
-        }
-      }
       var parentDir, prefix;
       try {
         var stat = fs.statSync(absTarget);
@@ -87,12 +79,17 @@ function attachGlobalWs(opts) {
         parentDir = path.dirname(absTarget);
         prefix = path.basename(absTarget).toLowerCase();
       }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, parentDir)) {
+        sendTo(ws, { type: "browse_dir_result", entries: [], error: "Directory access is not permitted" });
+        return;
+      }
       try {
         var dirItems = fs.readdirSync(parentDir, { withFileTypes: true });
         var dirEntries = [];
         for (var di = 0; di < dirItems.length; di++) {
           var d = dirItems[di];
           if (!d.isDirectory()) continue;
+          if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, path.join(parentDir, d.name))) continue;
           if (d.name.charAt(0) === ".") continue;
           if (IGNORED_DIRS.has(d.name)) continue;
           if (prefix && !d.name.toLowerCase().startsWith(prefix)) continue;
@@ -110,16 +107,9 @@ function attachGlobalWs(opts) {
     if (msg.type === "add_project") {
       var addPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
       var addAbs = path.resolve(addPath);
-      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
-        if (!ws._clayUser.linuxUser) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "No Linux user assigned" });
-          return;
-        }
-        var userHome = "/home/" + ws._clayUser.linuxUser;
-        if (addAbs !== userHome && (addAbs + "/").indexOf(userHome + "/") !== 0) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "Path not allowed. You can only add directories under " + userHome });
-          return;
-        }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, addAbs)) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Directory access is not permitted" });
+        return;
       }
       try {
         var addStat = fs.statSync(addAbs);
@@ -133,7 +123,7 @@ function attachGlobalWs(opts) {
       }
       if (typeof onAddProject === "function") {
         var result = onAddProject(addAbs, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: result.ok, slug: result.slug, error: result.error, existing: result.existing });
+        sendTo(ws, Object.assign({}, result, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }
@@ -159,7 +149,7 @@ function attachGlobalWs(opts) {
       }
       if (typeof onCreateProject === "function") {
         var createResult = onCreateProject(createName, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: createResult.ok, slug: createResult.slug, error: createResult.error });
+        sendTo(ws, Object.assign({}, createResult, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }

package/lib/server-home-chat-events.js

@@ -125,10 +125,10 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode, pendingAs
   for (var i = 0; i < history.length; i++) {
     var event = history[i];
     if (!event) continue;
-    if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && event.source === 'mcp-import') {
+    if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && ['mcp-import', 'mate-schedule', 'mcp_fallback', 'product-control'].indexOf(event.source) >= 0) {
       flushAssistant();
       var activeConsent = pendingAskUser === undefined || !!(pendingAskUser && pendingAskUser[event.id]);
-      messages.push({ role: 'question', flow: 'mcp_import', toolId: event.id, questions: homeDebateQuestions(event.input), status: activeConsent ? 'pending' : 'expired', error: activeConsent ? '' : 'This import consent is no longer active. Ask for a new scan and review.' });
+      messages.push({ role: 'question', flow: event.source === 'mcp-import' ? 'mcp_import' : 'mate_question', toolId: event.id, questions: homeDebateQuestions(event.input), status: activeConsent ? 'pending' : 'expired', error: activeConsent ? '' : 'This question is no longer active. Ask for a new review.' });
       continue;
     }
     if (event.type === "project_assignment_proposal" || event.type === "project_assignment_status") {
@@ -192,7 +192,7 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode, pendingAs
     } else if (interviewMode && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) {
       flushAssistant();
       messages.push({ role: "question", flow: mateCreationMode === true ? "mate_creation" : "debate", toolId: event.id, questions: homeDebateQuestions(event.input), status: "pending", error: "" });
-    } else if ((event.type === "ask_user_answered" || event.type === "home_debate_question_expired" || event.type === "home_mate_creation_question_expired" || event.type === "mcp_import_consent_expired") && event.toolId) {
+    } else if ((event.type === "ask_user_answered" || event.type === "home_debate_question_expired" || event.type === "home_mate_creation_question_expired" || event.type === "mcp_import_consent_expired" || event.type === "mate_schedule_question_expired") && event.toolId) {
       for (var k = messages.length - 1; k >= 0; k--) {
         if (messages[k].role === "question" && messages[k].toolId === event.toolId) {
           messages[k].status = event.type === "ask_user_answered" ? "answered" : "expired";
@@ -305,7 +305,11 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
   if (event.type === "debate_proposal_resolved" && event.proposalId) return Object.assign({ type: "home_debate_proposal_resolved", proposalId: event.proposalId, action: event.action || "cancel", error: event.error || "" }, metadata);
   if (session && session.mateCreationMode === true && event.type === "mate_creation_proposal" && event.proposal) return Object.assign({ type: "home_mate_creation_proposal", proposal: event.proposal }, metadata);
   if (session && session.mateCreationMode === true && event.type === "mate_creation_proposal_resolved" && event.proposalId) return Object.assign({ type: "home_mate_creation_proposal_resolved", proposalId: event.proposalId, action: event.action || "cancel", createdMateId: event.mateId || null, mateName: event.mateName || null, error: event.error || "" }, metadata);
+  if (!(session && (session.debateSetupMode === true || session.mateCreationMode === true)) && event.type === 'tool_executing' && event.name === 'AskUserQuestion' && ['mate-schedule', 'mcp_fallback', 'product-control'].indexOf(event.source) >= 0) return Object.assign({ type: 'home_mate_question', toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
+  if (session && session.debateSetupMode !== true && session.mateCreationMode !== true && event.type === 'ask_user_answered' && event.toolId && (session.history || []).some(function (item) { return item.id === event.toolId && ['mate-schedule', 'mcp_fallback', 'product-control'].indexOf(item.source) >= 0; })) return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'answered', answers: event.answers }, metadata);
   if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && event.source === 'mcp-import') return Object.assign({ type: 'home_mcp_import_question', toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
+  if (event.type === 'product_control_question_expired') return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (event.type === 'mate_schedule_question_expired') return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
   if (event.type === 'mcp_import_consent_expired') return Object.assign({ type: 'home_mcp_import_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
   if (session && event.type === 'ask_user_answered' && event.toolId && (session.history || []).some(function (item) { return item.id === event.toolId && item.source === 'mcp-import'; })) return Object.assign({ type: 'home_mcp_import_question_resolved', toolId: event.toolId, status: 'answered', answers: event.answers }, metadata);
   if (session && session.debateSetupMode === true && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) {

package/lib/server-home-chat.js

@@ -31,7 +31,7 @@ function attachHomeChat(deps) {
       }
       if (!mateId && allMates[i].builtinKey === "clay") mate = allMates[i];
     }
-    if (!mate) return null;
+    if (!mate || mate.lifecycleDeletion) return null;
     var slug = "mate-" + mate.id;
     if (!projects.has(slug)) {
       if (!ensureRegistered) return null;
@@ -404,20 +404,8 @@ function attachHomeChat(deps) {
       historyError.sessionId = sessionReference(activeSession);
       throw historyError;
     }
-    sessionManager.sendAndRecord(activeSession, { type: "user_message", text: text });
     try {
-      if (!activeSession.isProcessing) {
-        activeSession.isProcessing = true;
-        activeSession.sentToolResults = {};
-        if (typeof options.onRecorded === "function") options.onRecorded(activeSession);
-        if (!activeSession.queryInstance && (!activeSession.worker || activeSession.messageQueue !== "worker")) {
-          sdk.startQuery(activeSession, options.queryText || text, null, null);
-        } else {
-          sdk.pushMessage(activeSession, options.queryText || text, null);
-        }
-      } else {
-        sdk.pushMessage(activeSession, options.queryText || text, null);
-      }
+      await require('./mate-message-delivery').deliver({ sm: sessionManager, sdk: sdk }, activeSession, text, options);
     } catch (error) {
       error.sessionId = sessionReference(activeSession);
       throw error;
@@ -456,7 +444,7 @@ function attachHomeChat(deps) {
       }
       return true;
     }
-    if (msg.type !== "issue_reference_resolve" && msg.type !== "home_debates_list" && msg.type !== "home_clay_ask" && msg.type !== "home_clay_session_resolve" && msg.type !== "home_clay_log_resolve" && msg.type !== "home_mate_present" && msg.type !== "home_mate_open" && msg.type !== "home_mate_sessions_list" && msg.type !== "home_mate_session_open" && msg.type !== "home_mate_send" && msg.type !== "home_mate_new_session" && msg.type !== "home_mate_debate_plan" && msg.type !== "home_debate_proposal_response" && msg.type !== "home_mcp_import_response" && msg.type !== "home_debate_question_response" && msg.type !== "home_debate_control" && msg.type !== "home_mate_creation_plan" && msg.type !== "home_mate_creation_question_response" && msg.type !== "home_mate_creation_proposal_response" && msg.type !== "home_mate_close" && msg.type !== "home_mate_memory_list" && msg.type !== "home_mate_knowledge_list" && msg.type !== "home_mate_models_get" && msg.type !== "home_mate_model_set") {
+    if (msg.type !== "issue_reference_resolve" && msg.type !== "home_debates_list" && msg.type !== "home_clay_ask" && msg.type !== "home_clay_session_resolve" && msg.type !== "home_clay_log_resolve" && msg.type !== "home_mate_present" && msg.type !== "home_mate_open" && msg.type !== "home_mate_sessions_list" && msg.type !== "home_mate_session_open" && msg.type !== "home_mate_send" && msg.type !== "home_mate_new_session" && msg.type !== "home_mate_debate_plan" && msg.type !== "home_debate_proposal_response" && msg.type !== "home_mcp_import_response" && msg.type !== "home_mate_question_response" && msg.type !== "home_debate_question_response" && msg.type !== "home_debate_control" && msg.type !== "home_mate_creation_plan" && msg.type !== "home_mate_creation_question_response" && msg.type !== "home_mate_creation_proposal_response" && msg.type !== "home_mate_close" && msg.type !== "home_mate_memory_list" && msg.type !== "home_mate_knowledge_list" && msg.type !== "home_mate_models_get" && msg.type !== "home_mate_model_set") {
       return false;
     }
 
@@ -481,7 +469,7 @@ function attachHomeChat(deps) {
       return true;
     }
 
-    if (msg.type === "home_mcp_import_response") { homeMcpConsent.respond(ws, userId, msg); return true; }
+    if (msg.type === "home_mcp_import_response" || msg.type === "home_mate_question_response") { homeMcpConsent.respond(ws, userId, msg); return true; }
     if (msg.type === "issue_reference_resolve") { resolveIssueLink(ws, msg); return true; }
     if (homeDebates.handle(ws, userId, msg)) return true;
     if (msg.type === "home_clay_ask") { homeClayEntry.start(ws, userId, msg); return true; }

package/lib/server-home-mate-creation.js

@@ -18,6 +18,7 @@ var INITIATION_PROMPT = [
   "Before the user answers again, your first and only action must be the next most useful AskUserQuestion. Before presenting it, do not use Bash, Read, Glob, Grep, workspace history, general knowledge, or any other inspection tool, and do not add a preface.",
   "When that tool returns the user's answer, continue the interview normally. Inspect only bounded context that is directly relevant to what the user supplied, and do not bulk-read knowledge files.",
   "Then explore the working relationship, recurring activities and context, communication preferences, autonomy, boundaries, and escalation behavior. Use grounded choices only when helpful. Every three to five exchanges, briefly summarize what you understand inside the next question and let the user correct it.",
+  "If the user explicitly asks the future Mate to send a scheduled message, collect the message and exact local date/time, timezone, and repetition only through one focused structured question at a time. Treat it as optional schedule intent: never create or register a job during this interview; include it only in propose_mate after reviewing it with the user.",
   "Choose the Mate's name last. Do not write files and do not create or update a Mate directly.",
   "When the identity is complete, end only by calling propose_mate with a concise public bio, structured preferences, and a complete first-person identityMarkdown. Do not emit a normal assistant preface or conclusion.",
 ].join("\n");

package/lib/server-home-mcp-consent.js

@@ -4,10 +4,10 @@ function attachHomeMcpConsent(ctx) {
     var found = ctx.findMateProject(userId, msg.mateId || null, false);
     var session = found && ctx.resolveHomeSession(found, userId, msg.sessionId);
     var tap = ctx.messageTap(ws, msg), pending = session && session.pendingAskUser && session.pendingAskUser[msg.toolId];
-    if (!ctx.isActorLive(ws, userId) || !found || !session || !tap || tap.mateSlug !== found.slug || tap.sessionId !== session.localId || (tap.requestId || null) !== (msg.requestId || null) || !pending || !pending.request || pending.request.source !== 'mcp-import') {
-      ctx.sendError(ws, found && found.mate.id, 'This owner import consent is unavailable or expired.', msg.requestId || null, msg.sessionId || null, 'question_expired', { toolId: msg.toolId }); return;
+    if (!ctx.isActorLive(ws, userId) || !found || !session || !tap || tap.mateSlug !== found.slug || tap.sessionId !== session.localId || (tap.requestId || null) !== (msg.requestId || null) || !pending || !pending.request || ['mcp-import', 'mate-schedule', 'mcp_fallback', 'product-control'].indexOf(pending.request.source) < 0) {
+      ctx.sendError(ws, found && found.mate.id, 'This owner question is unavailable or expired.', msg.requestId || null, msg.sessionId || null, 'question_expired', { toolId: msg.toolId }); return;
     }
-    if (!found.ctx.handleHomeAskUserResponse({ type: 'ask_user_response', toolId: msg.toolId, answers: msg.answers || {} }, session, ws)) ctx.sendError(ws, found.mate.id, 'This import consent could not be submitted. No import was authorized.', msg.requestId || null, msg.sessionId, 'question_refused', { toolId: msg.toolId });
+    if (!found.ctx.handleHomeAskUserResponse({ type: 'ask_user_response', toolId: msg.toolId, answers: msg.answers || {} }, session, ws)) ctx.sendError(ws, found.mate.id, 'This question could not be submitted.', msg.requestId || null, msg.sessionId, 'question_refused', { toolId: msg.toolId });
   }
   return { respond: respond };
 }

package/lib/server-mates.js

@@ -74,12 +74,26 @@ function attachMates(ctx) {
     var mateSlug = "mate-" + mate.id;
     var mateName = (mate.profile && mate.profile.displayName) || mate.name || "Mate";
     var registered = false;
+    var boundScheduleJob = null;
     var favorites;
     try {
       registered = addProject(mateDir, mateSlug, mateName, null, mate.createdBy || effectiveUserId, null, { isMate: true, mateDisplayName: mateName }) !== false;
       if (!registered) throw new Error("The Mate project could not be registered.");
+      var intent = mate.seedData && mate.seedData.scheduleIntent;
+      if (intent && intent.message && intent.scheduleRule) {
+        var targetProject = projects.get(mateSlug);
+        var targetManager = targetProject && targetProject.getSessionManager();
+        if (!targetProject || !targetManager || typeof targetProject.bindMateSchedule !== "function") throw new Error("The Mate schedule could not be bound to the new Mate.");
+        var targetSession = targetManager.createSessionRaw({ ownerId: users.isMultiUser() ? effectiveUserId : null, vendor: mate.vendor, model: mate.model });
+        boundScheduleJob = targetProject.bindMateSchedule(targetSession, intent, "creation-" + mate.id);
+        if (!boundScheduleJob) throw new Error("The Mate schedule could not be persisted.");
+        mates.updateMate(mateCtx, mate.id, { seedData: Object.assign({}, mate.seedData, { scheduleIntent: null }) });
+      }
       favorites = users.addDmFavorite(effectiveUserId, mate.id);
     } catch (error) {
+      if (targetSession && targetSession.mateSchedules && targetProject && typeof targetProject.cancelMateSchedule === "function") {
+        try { targetSession.mateSchedules.forEach(function (record) { targetProject.cancelMateSchedule(targetSession, record); }); } catch (cancelError) {}
+      }
       if (registered) try { removeProject(mateSlug); } catch (removeError) {}
       try { mates.deleteMate(mateCtx, mate.id); } catch (deleteError) {}
       throw error;
@@ -97,6 +111,10 @@ function attachMates(ctx) {
     return mate;
   }
 
+  var lifecycle = require("./mate-lifecycle-service").attachMateLifecycleService({
+    users: users, mates: mates, projects: projects, removeProject: removeProject, refresh: refreshTeamSections,
+  });
+
   // --- Mate message handlers ---
 
   function handleMessage(ws, msg) {
@@ -168,7 +186,7 @@ function attachMates(ctx) {
       for (var mi = 0; mi < mateList.length; mi++) {
         var m = mateList[mi];
         var mSlug = "mate-" + m.id;
-        if (!projects.has(mSlug)) {
+        if (!m.lifecycleDeletion && !projects.has(mSlug)) {
           var mDir = mates.getMateDir(mateCtx5, m.id);
           fs.mkdirSync(mDir, { recursive: true });
           var mName = (m.profile && m.profile.displayName) || m.name || "New Mate";
@@ -200,45 +218,9 @@ function attachMates(ctx) {
 
     if (msg.type === "mate_delete") {
       if (!msg.mateId) return true;
-      var mateCtx6 = mates.buildMateCtx(userId);
-      // Track deleted built-in mate key so it doesn't auto-recreate
-      var mateToDelete = mates.getMate(mateCtx6, msg.mateId);
-      if (mateToDelete && mateToDelete.builtinKey) {
-        users.addDeletedBuiltinKey(userId, mateToDelete.builtinKey);
-      }
-      var result = mates.deleteMate(mateCtx6, msg.mateId);
-      if (result.error) {
-        ws.send(JSON.stringify({ type: "mate_error", error: result.error }));
-      } else {
-        removeProject("mate-" + msg.mateId);
-        // Build updated available builtins list
-        var builtinDefs3 = require("./builtin-mates");
-        var missingKeys3 = mates.getMissingBuiltinKeys(mateCtx6);
-        var availableBuiltins3 = [];
-        for (var abk3 = 0; abk3 < missingKeys3.length; abk3++) {
-          var bDef3 = builtinDefs3.getBuiltinByKey(missingKeys3[abk3]);
-          if (bDef3) {
-            availableBuiltins3.push({
-              key: bDef3.key,
-              displayName: bDef3.displayName,
-              bio: bDef3.bio,
-              avatarCustom: bDef3.avatarCustom || "",
-              avatarStyle: bDef3.avatarStyle || "imprint",
-              avatarColor: bDef3.avatarColor || "",
-            });
-          }
-        }
-        ws.send(JSON.stringify({ type: "mate_deleted", mateId: msg.mateId, availableBuiltins: availableBuiltins3 }));
-        // Broadcast to all clients so strips update
-        projects.forEach(function (pCtx) {
-          pCtx.forEachClient(function (otherWs) {
-            if (otherWs === ws) return;
-            if (users.isMultiUser() && (!otherWs._clayUser || otherWs._clayUser.id !== userId)) return;
-            if (otherWs.readyState !== 1) return;
-            otherWs.send(JSON.stringify({ type: "mate_deleted", mateId: msg.mateId, availableBuiltins: availableBuiltins3 }));
-          });
-        });
-      }
+      lifecycle.remove(userId, msg.mateId, null, ws).then(function () {}, function (error) {
+        ws.send(JSON.stringify({ type: "mate_error", mateId: msg.mateId, error: error.message }));
+      });
       return true;
     }
 
@@ -303,33 +285,8 @@ function attachMates(ctx) {
         ws.send(JSON.stringify({ type: "mate_error", mateId: msg.mateId, error: "Use the Mate model selector to change this setting." }));
         return true;
       }
-      var mateCtx7 = mates.buildMateCtx(userId);
-      var updated;
-      try { updated = mates.updateMate(mateCtx7, msg.mateId, msg.updates); }
-      catch (error) {
-        ws.send(JSON.stringify({ type: "mate_error", mateId: msg.mateId, requestId: msg.requestId, error: "Could not save this Mate. Your changes were not acknowledged; try again." }));
-        return true;
-      }
-      if (updated && updated.error) {
-        ws.send(JSON.stringify({ type: "mate_error", mateId: msg.mateId, requestId: msg.requestId, error: updated.error }));
-        return true;
-      }
-      if (updated) {
-        ws.send(JSON.stringify({ type: "mate_updated", mate: updated, requestId: msg.requestId }));
-        // Broadcast update
-        projects.forEach(function (pCtx) {
-          pCtx.forEachClient(function (otherWs) {
-            if (otherWs === ws) return;
-            if (users.isMultiUser() && (!otherWs._clayUser || otherWs._clayUser.id !== userId)) return;
-            if (otherWs.readyState !== 1) return;
-            otherWs.send(JSON.stringify({ type: "mate_updated", mate: updated }));
-          });
-        });
-        // Re-enforce team sections across all mate projects so roster stays current
-        refreshTeamSections(mateCtx7);
-      } else {
-        ws.send(JSON.stringify({ type: "mate_error", mateId: msg.mateId, requestId: msg.requestId, error: "Mate not found" }));
-      }
+      try { lifecycle.update(userId, msg.mateId, msg.updates, ws, msg.requestId); }
+      catch (error) { ws.send(JSON.stringify({ type: "mate_error", mateId: msg.mateId, requestId: msg.requestId, error: error.message })); }
       return true;
     }
 
@@ -338,6 +295,7 @@ function attachMates(ctx) {
 
   return {
     handleMessage: handleMessage,
+    lifecycle: lifecycle,
     scheduleRegistryRefresh: scheduleRegistryRefresh,
     createReadyMateFromInterview: createReadyMateFromInterview,
   };

package/lib/server-owner-ui.js

@@ -0,0 +1,77 @@
+var crypto = require('crypto');
+// Only authenticated application sockets enumerated by the server are targets.
+function attachOwnerUi(ctx) {
+  var identities = new WeakMap(), capabilities = new WeakMap(), deliveries = new Map();
+  function alive(ws, owner) {
+    return ws && ws.readyState === 1 && (!ws._clayAuthCheck || ws._clayAuthCheck()) &&
+      (ctx.isMultiUser() ? !!owner && ws._clayUser && ws._clayUser.id === owner && !!ctx.findUser(owner) : !ws._clayUser);
+  }
+  function sockets(owner) {
+    var all = new Map();
+    ctx.forEachClient(function (ws, slug) {
+      if (!alive(ws, owner) || all.has(ws)) return;
+      if (!identities.has(ws)) identities.set(ws, 'viewer:' + crypto.randomUUID());
+      all.set(ws, { ws: ws, ref: identities.get(ws), slug: slug || null, sessionId: ws._clayActiveSession || null,
+        supported: capabilities.get(ws) === 1 && !ws._clayPane });
+    });
+    return Array.from(all.values());
+  }
+  function get(owner, ref) { return sockets(owner).find(function (item) { return item.ref === ref; }); }
+  function inspect(owner, ref) {
+    var viewer = get(owner, ref);
+    if (!viewer) throw new Error('The exact owner UI connection is absent or revoked.');
+    return viewer;
+  }
+  function check(owner, original) {
+    var live = inspect(owner, original.ref);
+    if (live.ws !== original.ws || live.slug !== original.slug || live.sessionId !== original.sessionId || live.supported !== original.supported) throw new Error('The selected viewer context changed. Inspect again.');
+    return live;
+  }
+  function deliver(owner, original, target, revalidate) {
+    revalidate(); var viewer = check(owner, original);
+    if (!viewer.supported) return { status: 'unsupported', delivered: false, acknowledged: false, visible: 'unknown' };
+    if (deliveries.size >= 100) {
+      deliveries.forEach(function (item, key) { if (Date.now() - item.created > 300000) deliveries.delete(key); });
+      if (deliveries.size >= 100) throw new Error('UI delivery capacity is full; wait for earlier attempts to expire.');
+    }
+    var id = 'navigation:' + crypto.randomUUID();
+    var record = { owner: owner, viewer: viewer, target: target, revalidate: revalidate, created: Date.now(), claimed: false,
+      result: { status: 'delivered', deliveryId: id, delivered: false, acknowledged: false, visible: 'unknown' } };
+    deliveries.set(id, record);
+    try {
+      viewer.ws.send(JSON.stringify({ type: 'clay_navigation_offer', deliveryId: id }));
+      if (!alive(viewer.ws, owner)) throw new Error('Viewer authorization or connection ended during delivery.');
+      record.result.delivered = true;
+    } catch (error) { record.result.status = 'failed'; record.result.error = error.message; record.result.retrySafe = false; }
+    return Object.assign({}, record.result);
+  }
+  function read(owner, id) {
+    var record = deliveries.get(id);
+    if (!record || record.owner !== owner) throw new Error('No delivery exists for this owner.');
+    record.revalidate();
+    return Object.assign({}, record.result);
+  }
+  function handleMessage(ws, msg) {
+    if (['clay_ui_ready', 'clay_navigation_claim', 'clay_navigation_ack'].indexOf(msg.type) < 0) return false;
+    var owner = ctx.isMultiUser() ? ws._clayUser && ws._clayUser.id : null;
+    if (!sockets(owner).some(function (item) { return item.ws === ws; })) return true;
+    if (msg.type === 'clay_ui_ready') { if (msg.version === 1) capabilities.set(ws, 1); return true; }
+    var record = deliveries.get(msg.deliveryId);
+    if (!record || record.viewer.ws !== ws || record.owner !== owner || Date.now() - record.created > 30000) return true;
+    try {
+      record.revalidate();
+      if (msg.type === 'clay_navigation_claim') {
+        if (record.claimed) return true;
+        check(owner, record.viewer); record.claimed = true;
+        ws.send(JSON.stringify({ type: 'clay_navigation_apply', deliveryId: msg.deliveryId, target: record.target }));
+      } else if (record.claimed && !record.result.acknowledged && ['accepted', 'refused', 'failed'].indexOf(msg.status) >= 0) {
+        record.result.acknowledged = true;
+        // Accepted only confirms invocation of the existing navigator, never rendering.
+        record.result.clientStatus = msg.status;
+      }
+    } catch (error) { record.result.status = 'failed'; record.result.error = error.message; record.result.retrySafe = false; }
+    return true;
+  }
+  return { list: sockets, inspect: inspect, check: check, deliver: deliver, read: read, handleMessage: handleMessage };
+}
+module.exports = { attachOwnerUi: attachOwnerUi };

package/lib/server-path-access.js

@@ -0,0 +1,38 @@
+// Directory pickers and project registration must not become content-access
+// bypasses through another spelling, symlink or nested directory.
+var fs = require("fs");
+var path = require("path");
+function inside(root, target) {
+  var relative = path.relative(root, target);
+  return relative !== ".." && relative.indexOf(".." + path.sep) !== 0 && !path.isAbsolute(relative);
+}
+function attachPathAccess(ctx) {
+  return function (userId, requested) {
+    if (!ctx.users.isMultiUser()) return true;
+    var user = userId && ctx.users.findUserById(userId);
+    if (!user) return false;
+    var target;
+    try { target = fs.realpathSync(requested); } catch (error) { return false; }
+    var allowed = false;
+    var denied = false;
+    ctx.projects.forEach(function (project, slug) {
+      var status = project.getStatus();
+      var root;
+      try { root = fs.realpathSync(status.path); } catch (error) { return; }
+      if (inside(root, target) || inside(target, root)) {
+        if (!ctx.canAccess(userId, slug)) denied = true;
+        else if (inside(root, target)) allowed = true;
+      }
+    });
+    if (denied) return false;
+    if (ctx.osUsers) {
+      if (!user.linuxUser) return false;
+      try {
+        var identity = ctx.resolveIdentity(user.linuxUser);
+        return inside(fs.realpathSync(identity.home), target);
+      } catch (error) { return false; }
+    }
+    return allowed || ctx.users.getAllUsers().length === 1;
+  };
+}
+module.exports = { attachPathAccess: attachPathAccess };