clay-server 5.2.0-beta.4 → 5.2.0-beta.5

package/lib/server-project-removal.js

@@ -0,0 +1,22 @@
+// Shared runtime removal used by the server callback and lifecycle controls.
+function removeProjectRuntime(projects, slug, awaitCompletion, registryRefresh) {
+  var project = projects.get(slug);
+  if (!project) return false;
+  var wasMate = project.getStatus().isMate;
+  var shutdownResult = project.destroy();
+  if (!awaitCompletion) projects.delete(slug);
+  if (shutdownResult && typeof shutdownResult.catch === 'function') {
+    shutdownResult.catch(function (error) {
+      console.error('[server] Project destroy failed for ' + slug + ':', error && error.message ? error.message : error);
+    });
+  }
+  if (!wasMate && registryRefresh) registryRefresh();
+  if (awaitCompletion) return Promise.resolve(shutdownResult).then(function (result) {
+    if (result !== true) throw new Error('Project runtime shutdown did not complete successfully: ' + slug);
+    if (projects.get(slug) !== project) throw new Error('Project runtime was replaced during shutdown: ' + slug);
+    projects.delete(slug);
+    return true;
+  });
+  return true;
+}
+module.exports = { removeProjectRuntime: removeProjectRuntime };

package/lib/server.js

@@ -219,6 +219,14 @@ function createServer(opts) {
   var isRequestAuthed = auth.isRequestAuthed;
   var parseCookies = auth.parseCookies;
 
+  var projectAdminOverview = require("./project-admin-overview");
+
+  function administrativeMetadata(userId, slug) {
+    var user = userId && users.findUserById(userId);
+    var context = projects.get(slug);
+    return projectAdminOverview.metadataFor(user, context && context.getStatus(), onGetProjectAccess && onGetProjectAccess(slug), users);
+  }
+
   function canUserAccessSlug(userId, slug) {
     if (!userId || !slug) return false;
     var project = projects && projects.get(slug);
@@ -237,6 +245,13 @@ function createServer(opts) {
     return users.canAccessProject(userId, access) === true;
   }
 
+  var projects = new Map(); // slug → projectContext
+  var lifecycleRuntime = require("./project-lifecycle-runtime").attachLifecycleRuntime({ projects: projects });
+  var canUsePath = require("./server-path-access").attachPathAccess({
+    users: users, projects: projects, canAccess: canUserAccessSlug, osUsers: osUsers,
+    resolveIdentity: require("./os-users").resolveOsUserInfo,
+  });
+
   var realVersion = require("../package.json").version;
   var currentVersion = debug ? "0.0.9" : realVersion;
 
@@ -341,7 +356,6 @@ function createServer(opts) {
   var caContent = caPath ? (function () { try { return fs.readFileSync(caPath); } catch (e) { return null; } })() : null;
 
   // --- Project registry ---
-  var projects = new Map(); // slug → projectContext
   var assignmentService = attachWorkspaceAssignmentService({
     storageDir: path.join(CONFIG_DIR, "workspace-assignments"),
     getProjects: function () { return projects; },
@@ -363,6 +377,29 @@ function createServer(opts) {
     },
     assignmentService: assignmentService,
   });
+  var ownerUiService = require('./server-owner-ui').attachOwnerUi({
+    isMultiUser: users.isMultiUser, findUser: users.findUserById,
+    forEachClient: function (visit) {
+      if (globalWs) globalWs.forEachClient(function (ws) { visit(ws, null); });
+      projects.forEach(function (project, slug) { project.forEachClient(function (ws) { visit(ws, slug); }); });
+    }
+  });
+  var clayProductControl = require("./clay-product-control").attachClayProductControl({
+    getOwnerUi: function () { return ownerUiService; },
+    getNotifications: function () { return _globalNotifications; },
+    getRecordServices: function () { return { issues: issuesService, logs: projectLogsService }; },
+    projectLifecycle: opts.projectLifecycle || null,
+    getMateLifecycle: function () { return mateHandler && mateHandler.lifecycle; },
+    getMateDir: function (ownerId, mateId) { return mates.getMateDir(mates.buildMateCtx(users.isMultiUser() ? ownerId : null), mateId); },
+    lifecyclePermissions: function (user) { return users.getEffectivePermissions(user, osUsers); },
+    canUsePath: canUsePath,
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    onGetProjectAccess: onGetProjectAccess,
+    canAccessProject: function (userId, access) { return users.canAccessProject(userId, access) === true; },
+    findUser: function (userId) { return users.findUserById(userId); },
+    resolveMate: function (userId, mateId) { return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId); },
+  });
   // Project access is resolved from the authoritative project record, not from
   // getStatus(), which carries no visibility or allowedUsers fields.
   var projectLogsService = attachProjectLogsService({
@@ -409,6 +446,7 @@ function createServer(opts) {
   // Mate Knowledge reads the synchronized Knowledge records. The Mate list is
   // derived from the owning user alone, so a binding can never span users.
   var mateKnowledgeService = attachMateKnowledgeService({
+    findUser: function (userId) { return users.findUserById(userId); },
     getProjects: function () { return projects; },
     isMultiUser: function () { return users.isMultiUser(); },
     resolveMate: function (userId, mateId) {
@@ -547,7 +585,28 @@ function createServer(opts) {
     broadcastAll: function (msg) { broadcastAll(msg); },
     sendToUser: function (userId, msg) { sendToUser(userId, msg); },
     pushModule: pushModule,
+    forEachClient: forEachAppClient,
+    getUsers: function () { return users.getAllUsers(); },
+    canView: function (ws, notification) { return canViewNotification(ws && ws._clayUser && ws._clayUser.id, notification); },
+    canViewPrincipal: function (principal, notification) { return canViewNotification(principal.userId, notification); },
   });
+  function canViewNotification(userId, notification) {
+      if (!users.isMultiUser()) return true;
+      if (!userId || !users.findUserById(userId)) return false;
+      if (notification.targetUserId && notification.targetUserId !== userId) return false;
+      if (notification.slug) {
+        if (!canUserAccessSlug(userId, notification.slug)) return false;
+        if (notification.sessionId) {
+          var project = projects.get(notification.slug);
+          var session = project && project.getSessionManager().sessions.get(notification.sessionId);
+          var status = project && project.getStatus();
+          var access = status && status.isMate ? { isMate: true, visibility: "private", ownerId: status.projectOwnerId } : onGetProjectAccess(notification.slug);
+          if (!session || !users.canAccessSession(userId, session, access)) return false;
+        }
+        return !notification.ownerId || notification.ownerId === userId || !!notification.sessionId;
+      }
+      return notification.targetUserId === userId || notification.ownerId === userId;
+  }
 
   // --- Security headers ---
   var securityHeaders = {
@@ -980,8 +1039,8 @@ function createServer(opts) {
       var projectList = [];
       var infoUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
       projects.forEach(function (ctx, slug) {
-        if (users.isMultiUser() && (!infoUser || !canUserAccessSlug(infoUser.id, slug))) return;
-        projectList.push({ slug: slug, project: ctx.project });
+        if (users.isMultiUser() && (!infoUser || (!canUserAccessSlug(infoUser.id, slug) && !administrativeMetadata(infoUser.id, slug)))) return;
+        projectList.push({ slug: slug, project: ctx.project, contentAccess: !users.isMultiUser() || canUserAccessSlug(infoUser.id, slug) });
       });
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ projects: projectList, version: currentVersion, authenticated: true }));
@@ -1057,8 +1116,14 @@ function createServer(opts) {
     if (users.isMultiUser() && !isMcpBridgeAuthenticated) {
       var httpUser = getMultiUserFromReq(req);
       if (!httpUser || !canUserAccessSlug(httpUser.id, slug)) {
-        res.writeHead(302, { "Location": "/" });
-        res.end();
+        var overview = httpUser && administrativeMetadata(httpUser.id, slug);
+        if (overview && req.method === "GET" && (projectUrlForAuth === "/" || projectUrlForAuth === "/index.html")) {
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+          res.end(projectAdminOverview.page(overview, getVisibleProjects(httpUser.id)));
+          return;
+        }
+        res.writeHead(403, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(JSON.stringify({ error: "Project content access is not permitted" }));
         return;
       }
     }
@@ -1167,6 +1232,7 @@ function createServer(opts) {
   var globalWs = serverGlobalWs.attachGlobalWs({
     osUsers: osUsers,
     usersModule: users,
+    canUsePath: canUsePath,
     onAddProject: onAddProject,
     onCreateProject: onCreateProject,
     onCloneProject: onCloneProject,
@@ -1307,17 +1373,10 @@ function createServer(opts) {
     if (processingUpdateTimer) clearTimeout(processingUpdateTimer);
     processingUpdateTimer = setTimeout(function () {
       processingUpdateTimer = null;
-      var allProjectsList = getProjects();
       // Always send per-client to include cross-project unread counts
       projects.forEach(function (ctx, projSlug) {
         ctx.forEachClient(function (ws) {
-          var filtered = allProjectsList;
-          if (users.isMultiUser() && onGetProjectAccess) {
-            var wsUser = ws._clayUser;
-            filtered = wsUser ? allProjectsList.filter(function (p) {
-              return canUserAccessSlug(wsUser.id, p.slug);
-            }) : [];
-          }
+          var filtered = getVisibleProjects(ws._clayUser ? ws._clayUser.id : null);
           // Attach per-project unread counts for this client
           var unreadMap = getCrossProjectUnread(ws);
           var projectsWithUnread = filtered.map(function (p) {
@@ -1367,6 +1426,10 @@ function createServer(opts) {
   function addProject(cwd, slug, title, icon, projectOwnerId, worktreeMeta, extraOpts) {
     if (projects.has(slug)) return false;
     var extra = extraOpts || {};
+    if (extra.isMate) {
+      var registeredMate = mates.getMate(mates.buildMateCtx(users.isMultiUser() ? projectOwnerId : null), extra.mateId || path.basename(cwd));
+      if (registeredMate && registeredMate.lifecycleDeletion) return false;
+    }
     var ctx = createProjectContext({
       cwd: cwd,
       slug: slug,
@@ -1386,6 +1449,8 @@ function createServer(opts) {
         return mateHandler.createReadyMateFromInterview(ws, userId, definition);
       },
       workspaceQueryService: workspaceQueryService,
+      clayProductControl: clayProductControl,
+      resumeLifecycleProject: function (userId) { return opts.projectLifecycle ? opts.projectLifecycle.resumeRecovered(slug, userId) : true; },
       projectLogsService: projectLogsService,
       issuesService: issuesService,
       linearStorage: linear.storage,
@@ -1407,13 +1472,19 @@ function createServer(opts) {
         return !!(access && !access.error && users.canAccessProject(userId, access));
       },
       getProjectAccess: function () {
-        if (extra.isMate) return { isMate: true, visibility: "private", ownerId: projectOwnerId || null, allowedUsers: [] };
+        if (extra.isMate) {
+          var mate = mates.getMate(mates.buildMateCtx(users.isMultiUser() ? projectOwnerId : null), extra.mateId || path.basename(cwd));
+          return { isMate: true, visibility: "private", ownerId: projectOwnerId || null, allowedUsers: [], lifecycleExecutionPaused: !mate || !!mate.lifecycleDeletion };
+        }
         return onGetProjectAccess ? onGetProjectAccess(slug) : { visibility: "public", ownerId: projectOwnerId || null };
       },
       shouldSuppressResponseNotification: function (session) {
         return shouldSuppressHomeResponse(projects, slug, session);
       },
-      pushModule: pushModule,
+      pushModule: require("./project-push-access").scopedPush(pushModule, {
+        slug: slug, users: users, getProject: function (target) { return projects.get(target); },
+        canAccessProject: canUserAccessSlug, getAccess: onGetProjectAccess,
+      }),
       debug: debug,
       dangerouslySkipPermissions: dangerouslySkipPermissions,
       osUsers: osUsers,
@@ -1445,6 +1516,7 @@ function createServer(opts) {
           var status = ctx.getStatus();
           var recs = ctx.getSchedules();
           for (var i = 0; i < recs.length; i++) {
+            if (users.isMultiUser() && recs[i].ownerId !== userId) continue;
             // Shallow-copy full record and augment with project metadata
             var copy = {};
             var keys = Object.keys(recs[i]);
@@ -1502,6 +1574,7 @@ function createServer(opts) {
         return ctx.getSchedules().length;
       },
       canAccessProjectSlug: canUserAccessSlug,
+      canUsePath: canUsePath,
       onPresenceChange: broadcastPresenceChange,
       onProcessingChanged: broadcastProcessingChange,
       onSessionDone: function () { onSessionDone(slug); },
@@ -1655,6 +1728,7 @@ function createServer(opts) {
   }
 
   function handleDmMessage(ws, msg, routedProjectSlug) {
+    if (ownerUiService.handleMessage(ws, msg)) return true;
     if (cursorSharingService && cursorSharingService.handleMessage(ws, msg)) return true;
     if (defaultVendorService && defaultVendorService.handleMessage(ws, msg, routedProjectSlug)) return true;
     if (contextViewService && contextViewService.handleMessage(ws, msg)) return true;
@@ -1669,19 +1743,8 @@ function createServer(opts) {
     return false;
   }
 
-  function removeProject(slug) {
-    var ctx = projects.get(slug);
-    if (!ctx) return false;
-    var wasMate = ctx.getStatus().isMate;
-    var shutdownResult = ctx.destroy();
-    projects.delete(slug);
-    if (shutdownResult && typeof shutdownResult.catch === "function") {
-      shutdownResult.catch(function(err) {
-        console.error("[server] Project destroy failed for " + slug + ":", err && err.message ? err.message : err);
-      });
-    }
-    if (!wasMate) scheduleRegistryRefresh();
-    return true;
+  function removeProject(slug, awaitCompletion) {
+    return require('./server-project-removal').removeProjectRuntime(projects, slug, awaitCompletion, scheduleRegistryRefresh);
   }
 
   // Now that addProject and removeProject are defined, initialize mateHandler
@@ -1767,7 +1830,11 @@ function createServer(opts) {
   function getVisibleProjects(userId) {
     var visible = [];
     projects.forEach(function (ctx, slug) {
-      if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, slug))) return;
+      if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, slug))) {
+        var metadata = administrativeMetadata(userId, slug);
+        if (metadata) visible.push(metadata);
+        return;
+      }
       var status = ctx.getStatus();
       if (!status.isMate && onGetProjectAccess) {
         var access = onGetProjectAccess(slug);
@@ -1966,6 +2033,7 @@ function createServer(opts) {
     speech.destroy();
     var shutdowns = [];
     shutdowns.push(durableSchedulerLifecycle.shutdown());
+    shutdowns.push(lifecycleRuntime.shutdown());
     projects.forEach(function (ctx, slug) {
       console.log("[server] Destroying project:", slug);
       var result = ctx.destroy();
@@ -2033,6 +2101,8 @@ function createServer(opts) {
     isTLS: !!tlsOptions,
     addProject: addProject,
     removeProject: removeProject,
+    getProjectLifecycleTargets: lifecycleRuntime.targets,
+    closeProjectLifecycle: lifecycleRuntime.close,
     getProjects: getProjects,
     reorderProjects: reorderProjects,
     setProjectTitle: setProjectTitle,

package/lib/session-config-transition.js

@@ -0,0 +1,45 @@
+// Guarded configuration commit shared by SDK setters and permission transitions.
+// Provider acknowledgement is distinct from local persistence. Once a request
+// has crossed that boundary, failures never imply the provider was rolled back.
+async function applySessionConfig(ctx) {
+  var session = ctx.session, sm = ctx.sm, handle = session.queryInstance;
+  var generation = Number(session._sdkQueryGeneration || 0), owner = session.ownerId;
+  var paused = !!session._pendingMessageDrainPaused, signal = session.abortController && session.abortController.signal;
+  var attempted = false, acknowledged = false, persisted = false, previous = {};
+  function current() {
+    ctx.revalidate();
+    if (sm.sessions.get(session.localId) !== session || session.ownerId !== owner || session.queryInstance !== handle ||
+        Number(session._sdkQueryGeneration || 0) !== generation || session.taskStopRequested ||
+        !!session._pendingMessageDrainPaused !== paused || signal && signal.aborted) throw new Error("Target ownership, runtime, or Stop state changed during the configuration request.");
+  }
+  try {
+    current();
+    if (handle) {
+      if (typeof handle[ctx.method] !== "function") throw new Error("This provider cannot apply this configuration to the active runtime.");
+      attempted = true;
+      var reply = await handle[ctx.method](ctx.nativeValue);
+      if (reply === false || reply && reply.ok === false) throw new Error(reply && reply.error || "The provider refused the configuration change.");
+      acknowledged = true;
+      current();
+    }
+    var changes = typeof ctx.changes === "function" ? ctx.changes() : ctx.changes;
+    Object.keys(changes).forEach(function (key) { previous[key] = { present: Object.prototype.hasOwnProperty.call(session, key), value: session[key] }; });
+    Object.assign(session, changes);
+    try {
+      if (sm.saveSessionFile(session) !== true) throw new Error("Could not persist the configuration change.");
+      persisted = true;
+    } catch (error) {
+      Object.keys(previous).forEach(function (key) { if (previous[key].present) session[key] = previous[key].value; else delete session[key]; });
+      throw error;
+    }
+    // There is no await between the last authorization check, disk commit and
+    // publication. Never broadcast a desired value before its save succeeds.
+    ctx.publish();
+    return Object.assign({ ok: true, status: "completed", persisted: true, runtimeEffect: acknowledged ? "applied" : "none" }, changes);
+  } catch (error) {
+    return { ok: false, status: "failed", outcome: persisted ? "partial" : attempted ? "uncertain" : "failed", persisted: persisted,
+      runtimeEffect: acknowledged ? "applied" : attempted ? "unknown" : "none", retrySafe: !attempted && !persisted,
+      error: (persisted ? "The configuration was saved, but publication did not complete. " : "") + (attempted ? "The provider may retain the requested change; no external rollback was attempted. " : "") + (error.message || String(error)) };
+  }
+}
+module.exports = { applySessionConfig: applySessionConfig };

package/lib/session-folders.js

@@ -9,7 +9,7 @@
 //                                          also keeps its folder (or Unfiled) assignment
 //   orders:      { containerKey: [keys] }  manual order per container ("unfiled", custom id, "all")
 //   collapsed:   { containerKey: true }
-//   view:        { group, sort, direction }
+//   view:        { group, sort, direction, showDateHeadings }
 // sessionKey is the session's opaque, durable sessionOriginId.
 
 var crypto = require("crypto");
@@ -35,7 +35,7 @@ function defaultState() {
     favorites: [],
     orders: {},
     collapsed: {},
-    view: { group: "folders", sort: "activity", direction: "desc" },
+    view: { group: "folders", sort: "activity", direction: "desc", showDateHeadings: true },
     legacyFavoritesMigrated: false,
   };
 }
@@ -147,6 +147,7 @@ function normalizeState(raw) {
   var view = isPlainObject(source.view) ? source.view : {};
   if (SORTS.indexOf(view.sort) !== -1) state.view.sort = view.sort;
   if (DIRECTIONS.indexOf(view.direction) !== -1) state.view.direction = view.direction;
+  if (typeof view.showDateHeadings === "boolean") state.view.showDateHeadings = view.showDateHeadings;
   state.legacyFavoritesMigrated = source.legacyFavoritesMigrated === true;
   return state;
 }
@@ -334,6 +335,10 @@ function applyRaw(input, op, env) {
       if (DIRECTIONS.indexOf(op.direction) === -1) return { error: "Invalid direction" };
       state.view.direction = op.direction;
     }
+    if (op.showDateHeadings !== undefined) {
+      if (typeof op.showDateHeadings !== "boolean") return { error: "Invalid date heading setting" };
+      state.view.showDateHeadings = op.showDateHeadings;
+    }
     return { state: state };
   }
 

package/lib/session-github.js

@@ -33,22 +33,29 @@ function runGh(cwd, args, identity, input) {
 }
 async function readReference(cwd, url, identity, run, statusOnly) {
   var ref = parseReference(url);
-  var fields = "title,state,url" + (ref.kind === "pr" ? (statusOnly ? ",isDraft" : ",isDraft,headRefName,reviewDecision,statusCheckRollup") : "");
+  var fields = "title,state,url" + (ref.kind === "pr" ? (statusOnly ? ",isDraft,reviewDecision,reviewRequests" : ",isDraft,headRefName,reviewDecision,statusCheckRollup") : "");
   var data = await (run || runGh)(cwd, [ref.kind === "pr" ? "pr" : "issue", "view", String(ref.number), "--repo", ref.repository, "--json", fields], identity);
   var verified = parseReference(data.url);
   if (verified.url.toLowerCase() !== ref.url.toLowerCase()) throw new Error("GitHub returned a different reference.");
   ref.title = String(data.title || "").slice(0, 200);
   ref.state = data.state === "MERGED" ? "merged" : data.state === "CLOSED" ? "closed" : data.state === "OPEN" ? (data.isDraft ? "draft" : "open") : "unknown";
   ref.checkedAt = Date.now();
+  if (ref.kind === "pr") {
+    ref.review = ["APPROVED", "CHANGES_REQUESTED", "REVIEW_REQUIRED"].indexOf(data.reviewDecision) >= 0 ? data.reviewDecision : "";
+  }
   if (ref.kind === "pr" && !statusOnly) {
     ref.branch = String(data.headRefName || "").slice(0, 200);
-    ref.review = ["APPROVED", "CHANGES_REQUESTED", "REVIEW_REQUIRED"].indexOf(data.reviewDecision) >= 0 ? data.reviewDecision : "";
     ref.checks = (data.statusCheckRollup || []).slice(0, 30).map(function (check) {
       var target = check.detailsUrl || check.targetUrl || "";
       if (!/^https:\/\//i.test(target)) target = "";
       return { name: String(check.name || check.context || "Check").slice(0, 100), state: String(check.conclusion || check.state || check.status || "PENDING").slice(0, 40), url: target };
     });
   }
+  if (ref.kind === "pr" && statusOnly) {
+    ref.reviewRequests = Array.isArray(data.reviewRequests) ? data.reviewRequests.slice(0, 30).map(function (request) {
+      return String(request.login || "").trim().toLowerCase().slice(0, 100);
+    }).filter(Boolean) : [];
+  }
   return ref;
 }
 module.exports = { parseReference: parseReference, readReference: readReference, runGh: runGh };

package/lib/session-visibility.js

@@ -54,7 +54,7 @@ function handleDefaultChange(ctx, ws, msg) {
     ? ctx.usersModule.getEffectivePermissions(user, ctx.osUsers) : {};
   var isOwner = !!(user && access && access.ownerId && access.ownerId === user.id);
   var isAdmin = !!(user && user.role === "admin");
-  if (!user || !permissions.projectSettings || (!isOwner && !isAdmin)) {
+  if (!user || !permissions.projectSettings || !isOwner) {
     defaultChangeResult(ctx, ws, msg, { ok: false, error: "Project settings access is not permitted" });
     return true;
   }
@@ -98,7 +98,10 @@ function revokeViewers(ctx, session) {
       // Clear the server-side selection before reconnecting so no further
       // session events or input can cross the revoked access boundary.
       client._clayActiveSession = null;
-      if (client.readyState === 1) client.close(1008, "Session access changed");
+      if (client.readyState === 1) {
+        if (ctx.sendTo) ctx.sendTo(client, { type: "access_revoked", slug: ctx.slug });
+        client.close(1008, "Session access changed");
+      }
     });
   }
 }

package/lib/sessions.js

@@ -227,6 +227,11 @@ function createSessionManager(opts) {
       if (session.homeDebatePlanning) metaObj.homeDebatePlanning = true;
       if (session.homeDebatePhase) metaObj.homeDebatePhase = session.homeDebatePhase;
       if (session.homeDebateInitialTopic) metaObj.homeDebateInitialTopic = session.homeDebateInitialTopic;
+      if (session.mateScheduleDraft) metaObj.mateScheduleDraft = session.mateScheduleDraft;
+      if (session.mateSchedules) metaObj.mateSchedules = session.mateSchedules;
+      if (session.clayWorkspaceReceipts) metaObj.clayWorkspaceReceipts = session.clayWorkspaceReceipts;
+      if (session.clayMateChatReceipts) metaObj.clayMateChatReceipts = session.clayMateChatReceipts;
+      if (session.claySchedulingReceipts) metaObj.claySchedulingReceipts = session.claySchedulingReceipts;
       if (session.mateCreationMode) metaObj.mateCreationMode = true;
       if (session.homeMateCreationPhase) metaObj.homeMateCreationPhase = session.homeMateCreationPhase;
       if (session.homeClayEntryRequestId) metaObj.homeClayEntryRequestId = session.homeClayEntryRequestId;
@@ -386,6 +391,11 @@ function createSessionManager(opts) {
       if (m.homeDebatePlanning) session.homeDebatePlanning = true;
       if (m.homeDebatePhase) session.homeDebatePhase = m.homeDebatePhase;
       if (m.homeDebateInitialTopic) session.homeDebateInitialTopic = m.homeDebateInitialTopic;
+      if (m.mateScheduleDraft) session.mateScheduleDraft = m.mateScheduleDraft;
+      if (m.mateSchedules) session.mateSchedules = m.mateSchedules;
+      if (Array.isArray(m.clayWorkspaceReceipts)) session.clayWorkspaceReceipts = m.clayWorkspaceReceipts;
+      if (Array.isArray(m.clayMateChatReceipts)) session.clayMateChatReceipts = m.clayMateChatReceipts;
+      if (Array.isArray(m.claySchedulingReceipts)) session.claySchedulingReceipts = m.claySchedulingReceipts;
       if (m.mateCreationMode) session.mateCreationMode = true;
       if (m.homeMateCreationPhase) session.homeMateCreationPhase = m.homeMateCreationPhase;
       if (m.homeClayEntryRequestId) session.homeClayEntryRequestId = m.homeClayEntryRequestId;

package/lib/terminal-manager.js

@@ -1,4 +1,5 @@
 var { createTerminal } = require("./terminal");
+var crypto = require("crypto");
 
 var MAX_TERMINALS = 10;
 var SCROLLBACK_MAX = 50 * 1024; // 50 KB per terminal
@@ -48,6 +49,7 @@ function createTerminalManager(opts) {
     var id = nextId++;
     var session = {
       id: id,
+      identity: crypto.randomUUID(),
       pty: pty,
       scrollback: [],
       scrollbackSize: 0,
@@ -59,8 +61,11 @@ function createTerminalManager(opts) {
       lastActivityAt: Date.now(),
       exited: false,
       exitCode: null,
+      exitWaiters: [],
       subscribers: new Set(),
       ownerWs: ownerWs || null,
+      ownerId: ownerWs && ownerWs._clayUser ? ownerWs._clayUser.id : opts && opts.ownerId || null,
+      osIdentity: osUserInfo ? JSON.stringify([osUserInfo.user, osUserInfo.uid, osUserInfo.gid, osUserInfo.home]) : null,
       onExitHook: (opts && typeof opts.onExit === "function") ? opts.onExit : null,
       onDataHook: (opts && typeof opts.onData === "function") ? opts.onData : null,
     };
@@ -95,6 +100,7 @@ function createTerminalManager(opts) {
       session.exited = true;
       session.exitCode = e && e.exitCode != null ? e.exitCode : null;
       session.pty = null;
+      session.exitWaiters.splice(0).forEach(function (resolve) { resolve(true); });
 
       var msg = JSON.stringify({ type: "term_exited", id: id });
       for (var ws of session.subscribers) {
@@ -204,6 +210,34 @@ function createTerminalManager(opts) {
     if (terminals.size === 0) nextId = 1;
   }
 
+  // Keep the terminal registered until its actual exit acknowledges shutdown.
+  async function closeAndWait(id, control) {
+    var session = terminals.get(id);
+    if (!session) throw new Error("Terminal closure cannot be confirmed: runtime is missing.");
+    if (control) { control.revalidate(); if (session.identity !== control.identity) throw new Error('The exact terminal identity changed.'); }
+    if (!session.exited) {
+      if (!session.pty) throw new Error("Terminal closure is unconfirmed.");
+      var timer, waiter;
+      var exited = new Promise(function (resolve, reject) {
+        waiter = resolve; session.exitWaiters.push(waiter);
+        timer = setTimeout(function () { reject(new Error("Terminal exit acknowledgement timed out.")); }, 5000);
+      });
+      try { session.pty.kill(); await exited; }
+      catch (error) { exited.catch(function () {}); throw error; }
+      finally { clearTimeout(timer); var index = session.exitWaiters.indexOf(waiter); if (index >= 0) session.exitWaiters.splice(index, 1); }
+    }
+    if (terminals.get(id) !== session) {
+      var replaced = new Error('Terminal was replaced during shutdown.');
+      if (control) replaced.productControlResult = { runtimeEffect: session.exited ? 'exited' : 'closure_unconfirmed', replacementRetained: true, retrySafe: false };
+      throw replaced;
+    }
+    if (control) {
+      try { control.revalidate(); }
+      catch (error) { error.productControlResult = { runtimeEffect: 'exited', retained: true, retrySafe: false }; throw error; }
+    }
+    close(id); return true;
+  }
+
   function rename(id, title) {
     var session = terminals.get(id);
     if (!session) return;
@@ -298,6 +332,24 @@ function createTerminalManager(opts) {
     write: write,
     resize: resize,
     close: close,
+    closeAndWait: closeAndWait,
+    inspect: function (id) {
+      var terminal = terminals.get(id);
+      return terminal ? { id: id, identity: terminal.identity, ownerId: terminal.ownerId, osIdentity: terminal.osIdentity, title: terminal.title, kind: terminal.kind, exited: terminal.exited, cols: terminal.cols, rows: terminal.rows, totalBytesWritten: terminal.totalBytesWritten } : null;
+    },
+    resizeExact: function (id, cols, rows, identity, revalidate) {
+      revalidate();
+      var terminal = terminals.get(id);
+      if (!terminal || terminal.identity !== identity || !terminal.pty) throw new Error('The exact terminal is unavailable for resizing.');
+      terminal.pty.resize(cols, rows);
+      revalidate();
+      if (terminals.get(id) !== terminal) throw new Error('Terminal was replaced during resize.');
+      terminal.cols = cols; terminal.rows = rows;
+      var message = JSON.stringify({ type: 'term_resized', id: id, cols: cols, rows: rows });
+      terminal.subscribers.forEach(function (ws) { if (ws.readyState === 1) ws.send(message); });
+      return true;
+    },
+    identity: function (id) { var terminal = terminals.get(id); return terminal ? terminal.identity : null; },
     rename: rename,
     list: list,
     getScrollback: getScrollback,

package/lib/users-permissions.js

@@ -64,15 +64,12 @@ function attachPermissions(deps) {
   // --- Project access helpers ---
 
   function canAccessProject(userId, project) {
-    if (!project) return false;
+    if (!project || !userId || !findUserById(userId) || project.ownershipRecovery === "required") return false;
     if (project.isMate === true || (typeof project.slug === "string" && project.slug.indexOf("mate-") === 0)) {
       return !!userId && !!project.ownerId && project.ownerId === userId;
     }
     // Public projects are accessible to all authenticated users
     if (!project.visibility || project.visibility === "public") return true;
-    // Admin always has access
-    var user = findUserById(userId);
-    if (user && user.role === "admin") return true;
     // Owner always has access to their own project
     if (project.ownerId && project.ownerId === userId) return true;
     // Private project -- check allowedUsers
@@ -96,10 +93,7 @@ function attachPermissions(deps) {
       return !!userId && !!session.ownerId && session.ownerId === userId;
     }
     if (session.userKnowledgeOwnerId) return !!userId && session.userKnowledgeOwnerId === userId && session.ownerId === userId;
-    // Resolve the stored user record so client-supplied roles cannot elevate access.
-    var user = findUserById(userId);
-    if (user && user.role === "admin") return true;
-    // Sessions without ownerId are legacy -- only admin can see them
+    // Unowned historical sessions require explicit recovery; role is not ownership.
     if (!session.ownerId) return false;
     // Owner can always see their own sessions
     if (session.ownerId === userId) return true;

package/lib/users.js

@@ -155,6 +155,10 @@ function getOtherUsers(excludeUserId) {
 }
 
 function removeUser(userId) {
+  var registered = require("./config").loadConfig();
+  if (registered && (registered.projects || []).some(function (project) {
+    return !require("./project-ownership").isPersonal(project) && project.ownerId === userId;
+  })) return { error: "Transfer ordinary owned projects before deleting this account." };
   var data = loadUsers();
   var before = data.users.length;
   data.users = data.users.filter(function (u) { return u.id !== userId; });

package/lib/workspace-query-access.js

@@ -96,7 +96,10 @@ function attachWorkspaceQueryAccess(deps) {
     // as ownership would let a stale status skip the authoritative record.
     var access = record(status);
     if (!access) return denied;
-    if (access.ownerId && access.ownerId === principal.userId) return { owned: true, accessible: true };
+    if (access.ownerId && access.ownerId === principal.userId) {
+      var ownerPermitted = permitted(principal.userId, access);
+      return { owned: ownerPermitted, accessible: ownerPermitted };
+    }
     return { owned: false, accessible: permitted(principal.userId, access) };
   }
 

package/lib/ws-schema.js

@@ -495,10 +495,11 @@ var schema = {
   "note_written":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Agent created or updated a sticky note" },
   "note_update":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Update a sticky note" },
   "note_updated":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was updated" },
-  "note_close":               { direction: "c2s", handler: "lib/project-user-message.js", description: "Close a sticky note (reversible; never deletes)" },
+  "note_update_result":        { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Correlated sticky note update result" },
+  "note_close":               { direction: "c2s", handler: "lib/project-user-message.js", description: "Close a sticky note; human draft-aware requests remove empty notes, tool and legacy closes stay reversible" },
   "note_reopen":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Reopen a closed sticky note" },
   "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Retired: older clients still send this; handled as a non-destructive close" },
-  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Retired: never sent. Closing broadcasts note_updated instead" },
+  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "A sticky note was permanently removed after a human-authorized storage transaction" },
   "note_list_request":        { direction: "c2s", handler: "lib/project-user-message.js", description: "Request the full notes list" },
   "note_bring_front":         { direction: "c2s", handler: "lib/project-user-message.js", description: "Bring a note to front (update z-order)" },
   "notes_list":               { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sticky notes" },
@@ -809,6 +810,11 @@ var schema = {
   "default_vendor_get":       { direction: "c2s", handler: "lib/server-default-vendor.js", description: "Read the authenticated user's New session vendor preference" },
   "default_vendor_set":       { direction: "c2s", handler: "lib/server-default-vendor.js", description: "Validate and persist the authenticated user's New session vendor preference" },
   "default_vendor_state":     { direction: "s2c", handler: "lib/public/modules/default-vendor.js", description: "Correlated or same-user-broadcast New session vendor preference" },
+  "clay_ui_ready":            { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Advertise exact owner UI navigation support on this socket" },
+  "clay_navigation_offer":    { direction: "s2c", handler: "lib/public/modules/clay-owner-navigation.js", description: "Offer one exact reviewed navigation to a selected owner connection" },
+  "clay_navigation_claim":    { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Claim an offered navigation with live source/target revalidation" },
+  "clay_navigation_apply":    { direction: "s2c", handler: "lib/public/modules/clay-owner-navigation.js", description: "Invoke the shared conversation navigator after live claim" },
+  "clay_navigation_ack":      { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Client invocation acknowledgement; never proof of visible rendering" },
   "context_view_get":         { direction: "c2s", handler: "lib/server-context-view.js", description: "Read the authenticated user's context display preference" },
   "context_view_set":         { direction: "c2s", handler: "lib/server-context-view.js", description: "Persist the authenticated user's context display preference" },
   "context_view_state":       { direction: "s2c", handler: "lib/public/modules/context-view-preference.js", description: "Correlated or same-user-broadcast context display preference" },