clay-server 5.2.0-beta.4 → 5.2.0-beta.5

package/lib/daemon.js

@@ -67,6 +67,8 @@ try {
   console.error("[daemon] ensureMultiUser threw (continuing):", e && e.message);
 }
 
+config = require("./project-ownership").repair(config, usersModule.getAllUsers(), saveConfig, osUsersMod.resolveOsUserInfo);
+
 if (projectLogContext.initializeProjectKnowledge(config)) {
   saveConfig(config);
   console.log("[daemon] Assigned stable knowledge identities to existing projects");
@@ -187,7 +189,14 @@ function registerProjectWorktrees(project, requestUser) {
   }
 }
 
+var projectLifecycle = require("./daemon-project-lifecycle").attachProjectLifecycle({
+  getConfig: function () { return config; }, setConfig: function (next) { config = next; }, saveConfig: saveConfig,
+  getRelay: function () { return relay; }, resolveIdentity: osUsersMod.resolveOsUserInfo,
+  findUser: usersModule.findUserById, registerWorktrees: registerProjectWorktrees,
+});
+var lifecycleCallbacks = require("./daemon-project-lifecycle-callbacks").attachLifecycleCallbacks({ service: projectLifecycle });
 var relay = createServer({
+  projectLifecycle: projectLifecycle,
   tlsOptions: tlsOptions,
   caPath: caRoot,
   builtinCert: config.builtinCert || false,
@@ -198,122 +207,11 @@ var relay = createServer({
   osUsers: config.osUsers || false,
   lanHost: lanIp ? lanIp + ":" + config.port : null,
   getRemovedProjects: function (userId) { return getFilteredRemovedProjects(config, userId); },
-  onAddProject: function (absPath, wsUser) {
-    // Check if already registered
-    for (var j = 0; j < config.projects.length; j++) {
-      if (config.projects[j].path === absPath) {
-        return { ok: true, slug: config.projects[j].slug, existing: true };
-      }
-    }
-    var slugs = config.projects.map(function (p) { return p.slug; });
-    var slug = generateSlug(absPath, slugs);
-    var projectEntry = { path: absPath, slug: slug, addedAt: Date.now(), visibility: "private" };
-    projectEntry.projectKnowledgeId = rememberedProjectKnowledgeId(absPath);
-    // The user who adds a project always becomes the owner
-    if (wsUser && wsUser.id) {
-      projectEntry.ownerId = wsUser.id;
-    }
-    config.projects.push(projectEntry);
-    relay.addProject(absPath, slug, null, null, wsUser ? wsUser.id : null, null, projectRuntimeOptions(projectEntry));
-    // Remove from removedProjects if present
-    if (config.removedProjects) {
-      config.removedProjects = config.removedProjects.filter(function (rp) { return rp.path !== absPath; });
-    }
-    saveConfig(config);
-    try { syncClayrc(config.projects); } catch (e) {}
-    console.log("[daemon] Added project (web):", slug, "→", absPath);
-    // OS users mode: grant ACL to project owner
-    if (config.osUsers) {
-      var newProj = config.projects[config.projects.length - 1];
-      if (newProj.ownerId) {
-        var ownerUser = usersModule.findUserById(newProj.ownerId);
-        if (ownerUser && ownerUser.linuxUser) {
-          grantProjectAccess(absPath, ownerUser.linuxUser);
-        }
-      }
-    }
-    // Discover and register worktrees for the new project
-    registerProjectWorktrees(projectEntry, wsUser);
-    // Broadcast updated project list to all clients
-    relay.broadcastAll({
-      type: "projects_updated",
-      projects: relay.getProjects(),
-      projectCount: config.projects.length,
-    });
-    return { ok: true, slug: slug };
-  },
-  onCreateProject: function (projectName, wsUser) {
-    console.log("[daemon] onCreateProject wsUser:", JSON.stringify(wsUser ? { id: wsUser.id, role: wsUser.role, username: wsUser.username, linuxUser: wsUser.linuxUser } : null));
-    var os = require("os");
-    var execFileSync = require("child_process").execFileSync;
-    var baseDir;
-    if (config.osUsers) {
-      baseDir = "/var/clay/projects";
-    } else {
-      baseDir = config.projectsDir || path.join(REAL_HOME, "clay-projects");
-    }
-    try { fs.mkdirSync(baseDir, { recursive: true }); } catch (e) {}
-    // Generate slug and deduplicate
-    var slugs = config.projects.map(function (p) { return p.slug; });
-    var slug = generateSlug(path.join(baseDir, projectName), slugs);
-    var targetDir = path.join(baseDir, slug);
-    try {
-      fs.mkdirSync(targetDir, { recursive: true });
-      // Run git init
-      if (config.osUsers && wsUser) {
-        var linuxUser = wsUser.linuxUser;
-        if (linuxUser) {
-          var uidGid = null;
-          try {
-            uidGid = {
-              uid: parseInt(execFileSync("id", ["-u", linuxUser], { encoding: "utf8", stdio: "pipe" }).trim(), 10),
-              gid: parseInt(execFileSync("id", ["-g", linuxUser], { encoding: "utf8", stdio: "pipe" }).trim(), 10),
-            };
-          } catch (e) {}
-          if (uidGid) {
-            fs.chmodSync(targetDir, 0o700);
-            execFileSync("chown", ["-R", linuxUser + ":" + linuxUser, targetDir]);
-            var gitInit = osUsersMod.wrapSpawnAsUser("git", ["init"], { cwd: targetDir, uid: uidGid.uid, gid: uidGid.gid, env: { PATH: "/usr/local/bin:/usr/bin:/bin" } });
-            execFileSync(gitInit.command, gitInit.args, gitInit.options);
-          } else {
-            execFileSync("git", ["init"], { cwd: targetDir });
-          }
-        } else {
-          execFileSync("git", ["init"], { cwd: targetDir });
-        }
-      } else {
-        execFileSync("git", ["init"], { cwd: targetDir });
-      }
-    } catch (e) {
-      try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
-      return { ok: false, error: "Failed to create project: " + e.message };
-    }
-    // Register project - creator always becomes owner, default private
-    var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now(), visibility: "private" };
-    projectEntry.projectKnowledgeId = projectLogContext.createProjectKnowledgeId();
-    if (wsUser && wsUser.id) {
-      projectEntry.ownerId = wsUser.id;
-    }
-    relay.addProject(targetDir, slug, null, null, wsUser ? wsUser.id : null, null, projectRuntimeOptions(projectEntry));
-    config.projects.push(projectEntry);
-    saveConfig(config);
-    try { syncClayrc(config.projects); } catch (e) {}
-    console.log("[daemon] Created project:", slug, "→", targetDir, "entry:", JSON.stringify({ ownerId: projectEntry.ownerId, visibility: projectEntry.visibility }));
-    // OS users mode: grant ACL
-    if (config.osUsers && wsUser && wsUser.linuxUser) {
-      console.log("[daemon] Granting ACL:", targetDir, "→", wsUser.linuxUser);
-      grantProjectAccess(targetDir, wsUser.linuxUser);
-    } else if (config.osUsers) {
-      console.log("[daemon] Skipping ACL grant: osUsers=true but linuxUser=", wsUser && wsUser.linuxUser);
-    }
-    relay.broadcastAll({
-      type: "projects_updated",
-      projects: relay.getProjects(),
-      projectCount: config.projects.length,
-    });
-    return { ok: true, slug: slug };
-  },
+  onAddProject: lifecycleCallbacks.onAddProject,
+  onCreateProject: lifecycleCallbacks.onCreateProject,
   onCloneProject: function (cloneUrl, wsUser, callback) {
+    wsUser = wsUser && usersModule.findUserById(wsUser.id);
+    if (usersModule.isMultiUser() && !wsUser) { callback({ ok: false, error: "A valid account is required." }); return; }
     var os = require("os");
     var spawn = require("child_process").spawn;
     var execFileSync = require("child_process").execFileSync;
@@ -323,12 +221,15 @@ var relay = createServer({
     } else {
       baseDir = config.projectsDir || path.join(REAL_HOME, "clay-projects");
     }
-    try { fs.mkdirSync(baseDir, { recursive: true }); } catch (e) {}
     // Derive slug from repo URL
     var repoName = cloneUrl.replace(/\.git$/, "").split("/").pop() || "project";
     var slugs = config.projects.map(function (p) { return p.slug; });
     var slug = generateSlug(path.join(baseDir, repoName), slugs);
-    var targetDir = path.join(baseDir, slug);
+    var targetDir;
+    var directoryClaim;
+    var settled = false;
+    function finish(result) { if (settled) return; settled = true; callback(result); }
+    function cleanup() { if (directoryClaim) { try { directoryClaim.cleanup(); } catch (error) {} } }
     // Clone as user to use their git credentials
     var spawnOpts = { cwd: baseDir };
     if (config.osUsers && wsUser && wsUser.linuxUser) {
@@ -341,22 +242,23 @@ var relay = createServer({
         });
       } catch (e) {}
     }
-    // Pre-create target directory as root and chown to user
-    if (fs.existsSync(targetDir)) {
-      callback({ ok: false, error: "Target directory already exists: " + targetDir });
+    try {
+      directoryClaim = require("./project-directory-claim").claim({ baseDir: baseDir, slug: slug, projects: config.projects, userId: wsUser && wsUser.id });
+      targetDir = directoryClaim.path;
+      directoryClaim.assertOwned();
+      if (config.osUsers && wsUser && wsUser.linuxUser && spawnOpts.uid != null) fs.chownSync(targetDir, spawnOpts.uid, spawnOpts.gid);
+      directoryClaim.assertOwned();
+    } catch (error) {
+      cleanup();
+      finish({ ok: false, error: "Failed to prepare project directory: " + error.message });
       return;
     }
-    if (config.osUsers && wsUser && wsUser.linuxUser && spawnOpts.uid != null) {
-      try {
-        fs.mkdirSync(targetDir, { mode: 0o700 });
-        fs.chownSync(targetDir, spawnOpts.uid, spawnOpts.gid);
-      } catch (e) {
-        callback({ ok: false, error: "Failed to prepare project directory: " + e.message });
-        return;
-      }
-    }
-    var cloneSpawn = osUsersMod.wrapSpawnAsUser("git", ["clone", cloneUrl, targetDir], spawnOpts);
-    var proc = spawn(cloneSpawn.command, cloneSpawn.args, cloneSpawn.options);
+    var proc;
+    try {
+      directoryClaim.assertOwned();
+      var cloneSpawn = osUsersMod.wrapSpawnAsUser("git", ["clone", cloneUrl, targetDir], spawnOpts);
+      proc = spawn(cloneSpawn.command, cloneSpawn.args, cloneSpawn.options);
+    } catch (error) { cleanup(); finish({ ok: false, error: "Failed to start git clone: " + error.message }); return; }
     var stderrBuf = "";
     proc.stderr.on("data", function (chunk) { stderrBuf += chunk.toString(); });
     // 5 minute timeout
@@ -365,19 +267,23 @@ var relay = createServer({
     }, 5 * 60 * 1000);
     proc.on("close", function (code) {
       clearTimeout(cloneTimeout);
+      if (settled) return;
+      try { directoryClaim.assertOwned(); } catch (error) { finish({ ok: false, error: error.message }); return; }
       if (code !== 0) {
-        try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
+        cleanup();
         var errMsg = stderrBuf.trim().split("\n").pop() || "Clone failed (exit code " + code + ")";
-        callback({ ok: false, error: errMsg });
+        finish({ ok: false, error: errMsg });
         return;
       }
       // chown and restrict permissions if osUsers
       if (config.osUsers && wsUser && wsUser.linuxUser) {
         try {
+          directoryClaim.assertOwned();
           fs.chmodSync(targetDir, 0o700);
           execFileSync("chown", ["-R", wsUser.linuxUser + ":" + wsUser.linuxUser, targetDir]);
         } catch (e) {}
       }
+      if (usersModule.isMultiUser() && (!wsUser || !usersModule.findUserById(wsUser.id))) { finish({ ok: false, error: "The creating account is no longer available." }); return; }
       // Register project - creator always becomes owner
       // Creator always becomes owner, default private
       var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now(), visibility: "private" };
@@ -385,9 +291,11 @@ var relay = createServer({
       if (wsUser && wsUser.id) {
         projectEntry.ownerId = wsUser.id;
       }
-      relay.addProject(targetDir, slug, null, null, wsUser ? wsUser.id : null, null, projectRuntimeOptions(projectEntry));
-      config.projects.push(projectEntry);
-      saveConfig(config);
+      try {
+        directoryClaim.assertOwned();
+        config = require("./project-ownership").register(config, projectEntry, usersModule.getAllUsers(), saveConfig, osUsersMod.resolveOsUserInfo);
+      } catch (error) { finish({ ok: false, error: "Failed to register project: " + error.message }); return; }
+      relay.addProject(targetDir, slug, null, null, projectEntry.ownerId || null, null, projectRuntimeOptions(projectEntry));
       try { syncClayrc(config.projects); } catch (e) {}
       console.log("[daemon] Cloned project:", slug, "→", targetDir);
       if (config.osUsers && wsUser && wsUser.linuxUser) {
@@ -398,12 +306,13 @@ var relay = createServer({
         projects: relay.getProjects(),
         projectCount: config.projects.length,
       });
-      callback({ ok: true, slug: slug });
+      finish({ ok: true, slug: slug });
     });
     proc.on("error", function (err) {
       clearTimeout(cloneTimeout);
-      try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
-      callback({ ok: false, error: "Failed to start git clone: " + err.message });
+      if (settled) return;
+      cleanup();
+      finish({ ok: false, error: "Failed to start git clone: " + err.message });
     });
   },
   onRemoveProject: function (slug, userId) {
@@ -444,40 +353,7 @@ var relay = createServer({
       });
       return { ok: true };
     }
-    var found = null;
-    for (var j = 0; j < config.projects.length; j++) {
-      if (config.projects[j].slug === slug) { found = config.projects[j]; break; }
-    }
-    if (!found) return { ok: false, error: "Project not found" };
-    // Cascade remove worktrees belonging to this parent
-    cleanupWorktreesForParent(relay, slug);
-    // Save to removedProjects for re-add functionality
-    if (!config.removedProjects) config.removedProjects = [];
-    config.removedProjects.push({
-      path: found.path,
-      title: found.title || null,
-      icon: found.icon || null,
-      userId: userId || null,
-      projectKnowledgeId: found.projectKnowledgeId || null,
-      removedAt: Date.now(),
-    });
-    // Cap at 20 entries (oldest first)
-    if (config.removedProjects.length > 20) {
-      config.removedProjects = config.removedProjects.slice(config.removedProjects.length - 20);
-    }
-    relay.removeProject(slug);
-    config.projects = config.projects.filter(function (p) { return p.slug !== slug; });
-    saveConfig(config);
-    // Remove from .clayrc so it doesn't appear in restore prompt
-    if (found.path) { try { removeFromClayrc(found.path); } catch (e) {} }
-    try { syncClayrc(config.projects); } catch (e) {}
-    console.log("[daemon] Removed project (web):", slug);
-    relay.broadcastAll({
-      type: "projects_updated",
-      projects: relay.getProjects(),
-      projectCount: config.projects.length,
-    });
-    return { ok: true };
+    return lifecycleCallbacks.onRemoveProject(slug, userId);
   },
   onReorderProjects: function (slugs) {
     // Build a slug->project map from current projects
@@ -511,25 +387,8 @@ var relay = createServer({
     return { ok: true };
   },
   onSetProjectTitle: function (slug, newTitle) {
-    relay.setProjectTitle(slug, newTitle);
-    for (var ti = 0; ti < config.projects.length; ti++) {
-      if (config.projects[ti].slug === slug) {
-        if (newTitle) {
-          config.projects[ti].title = newTitle;
-        } else {
-          delete config.projects[ti].title;
-        }
-        break;
-      }
-    }
-    saveConfig(config);
-    try { syncClayrc(config.projects); } catch (e) {}
-    relay.broadcastAll({
-      type: "projects_updated",
-      projects: relay.getProjects(),
-      projectCount: config.projects.length,
-    });
-    return { ok: true };
+    if (isWorktreeSlug(slug)) { relay.setProjectTitle(slug, newTitle); return { ok: true }; }
+    return lifecycleCallbacks.onSetProjectTitle(slug, newTitle);
   },
   onSetProjectIcon: function (slug, newIcon) {
     relay.setProjectIcon(slug, newIcon);
@@ -553,30 +412,28 @@ var relay = createServer({
     return { ok: true };
   },
   onSetProjectSessionVisibilityDefault: function (slug, visibility) {
-    var result = daemonProjectAccess.setSessionVisibilityDefault(config, slug, visibility);
-    if (result.error) return { ok: false, error: result.error };
-    saveConfig(config);
-    relay.broadcastAll({ type: "projects_updated", projects: relay.getProjects(), projectCount: config.projects.length });
-    return result;
+    return projectLifecycle.update(slug, "session_visibility", visibility);
   },
   onProjectOwnerChanged: function (slug, ownerId) {
+    if (!config.osUsers) return projectLifecycle.update(slug, "owner", ownerId);
     if (slug.indexOf("mate-") === 0) return {error:"Mate ownership cannot be transferred."};
+    if (!ownerId || !usersModule.findUserById(ownerId)) return { error: "A valid owner is required." };
     console.log("[daemon] onProjectOwnerChanged:", slug, "→", ownerId);
+    var previousConfig = JSON.parse(JSON.stringify(config));
     var oldOwnerId = null;
     var projectIdx = -1;
     for (var oi = 0; oi < config.projects.length; oi++) {
       if (config.projects[oi].slug === slug) {
         oldOwnerId = config.projects[oi].ownerId || null;
         projectIdx = oi;
-        if (ownerId) {
-          config.projects[oi].ownerId = ownerId;
-        } else {
-          delete config.projects[oi].ownerId;
-        }
+        config.projects[oi].ownerId = ownerId;
         break;
       }
     }
-    saveConfig(config);
+    try { saveConfig(config); } catch (error) { config = previousConfig; throw error; }
+    relay.forEachProject(function (project, projectSlug) {
+      if (projectSlug === slug || daemonProjectAccess.parentSlugFor(projectSlug) === slug) project.setProjectOwner(ownerId);
+    });
     // OS users mode: revoke old owner ACL, grant new owner ACL
     if (config.osUsers && projectIdx >= 0) {
       var projectPath = config.projects[projectIdx].path;
@@ -615,18 +472,7 @@ var relay = createServer({
     return { envrc: "" };
   },
   onSetProjectEnv: function (slug, envrc) {
-    for (var ei = 0; ei < config.projects.length; ei++) {
-      if (config.projects[ei].slug === slug) {
-        if (envrc) {
-          config.projects[ei].envrc = envrc;
-        } else {
-          delete config.projects[ei].envrc;
-        }
-        saveConfig(config);
-        return { ok: true };
-      }
-    }
-    return { ok: false, error: "Project not found" };
+    return lifecycleCallbacks.onSetProjectEnv(slug, envrc);
   },
   onGetSharedEnv: function () {
     return { envrc: config.sharedEnv || "" };
@@ -927,6 +773,7 @@ var relay = createServer({
     spawnAndRestart();
   },
   onSetProjectVisibility: function (slug, visibility) {
+    if (!config.osUsers) return projectLifecycle.update(slug, "visibility", visibility);
     if (slug.indexOf("mate-") === 0) return {error:"Mates cannot be shared."};
     for (var i = 0; i < config.projects.length; i++) {
       if (config.projects[i].slug === slug) {
@@ -962,6 +809,7 @@ var relay = createServer({
     return { error: "Project not found" };
   },
   onSetProjectAllowedUsers: function (slug, allowedUsers) {
+    if (!config.osUsers && !daemonProjectAccess.parentSlugFor(slug)) return projectLifecycle.update(slug, "allowed_users", allowedUsers);
     var accessBefore = daemonProjectAccess.getProjectAccess(config, slug, config.osUsers);
     var result = daemonProjectAccess.setAllowedUsers(config, slug, allowedUsers);
     if (result.error) return result;
@@ -1131,11 +979,11 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       }
       var slugs = config.projects.map(function (p) { return p.slug; });
       var slug = generateSlug(absPath, slugs);
-      var projectEntry = { path: absPath, slug: slug, addedAt: Date.now(), visibility: "private" };
+      var projectEntry = { path: absPath, slug: slug, addedAt: Date.now(), visibility: "private", ownershipRecovery: "required" };
       projectEntry.projectKnowledgeId = rememberedProjectKnowledgeId(absPath);
-      relay.addProject(absPath, slug, null, null, null, null, projectRuntimeOptions(projectEntry));
-      config.projects.push(projectEntry);
-      saveConfig(config);
+      config = require("./project-ownership").register(config, projectEntry, usersModule.getAllUsers(), saveConfig, osUsersMod.resolveOsUserInfo);
+      var registeredProject = config.projects[config.projects.length - 1];
+      relay.addProject(absPath, slug, null, null, registeredProject.ownerId || null, null, projectRuntimeOptions(registeredProject));
       try { syncClayrc(config.projects); } catch (e) {}
       console.log("[daemon] Added project:", slug, "→", absPath);
       // Discover and register worktrees for the new project
@@ -1367,6 +1215,10 @@ var ipc = createIPCServer(socketPath(), function (msg) {
 var projects = config.projects || [];
 for (var i = 0; i < projects.length; i++) {
   var p = projects[i];
+  if (!projectLifecycle.canRestore(p)) {
+    console.log("[daemon] Project removal needs recovery; runtime remains stopped:", p.slug);
+    continue;
+  }
   if (fs.existsSync(p.path)) {
     console.log("[daemon] Adding project:", p.slug, "→", p.path);
     relay.addProject(p.path, p.slug, p.title, p.icon, p.ownerId, null, projectRuntimeOptions(p));
@@ -1413,7 +1265,7 @@ if (usersModule.isMultiUser()) {
       var mateDir = mates.getMateDir(mateCtx, m.id);
       var mateSlug = "mate-" + m.id;
       var mateName = (m.profile && m.profile.displayName) || m.name || "New Mate";
-      if (fs.existsSync(mateDir)) {
+      if (!m.lifecycleDeletion && fs.existsSync(mateDir)) {
         var mateDef = m.builtinKey ? require("./builtin-mates").getBuiltinByKey(m.builtinKey) : null;
         var isHost = !!(mateDef && mateDef.hostAgent);
         console.log("[daemon] Adding mate project:", mateSlug + (isHost ? " (host agent)" : ""));
@@ -1430,7 +1282,7 @@ if (usersModule.isMultiUser()) {
     var mateDir = mates.getMateDir(mateCtx, m.id);
     var mateSlug = "mate-" + m.id;
     var mateName = (m.profile && m.profile.displayName) || m.name || "New Mate";
-    if (fs.existsSync(mateDir)) {
+    if (!m.lifecycleDeletion && fs.existsSync(mateDir)) {
       var mateDef2 = m.builtinKey ? require("./builtin-mates").getBuiltinByKey(m.builtinKey) : null;
       var isHost2 = !!(mateDef2 && mateDef2.hostAgent);
       console.log("[daemon] Adding mate project:", mateSlug + (isHost2 ? " (host agent)" : ""));

package/lib/issues-service.js

@@ -129,25 +129,35 @@ function attachIssuesService(ctx) {
       principal: principal, worktreeOnly: authorization.worktreeOnly };
   }
 
-  function bind(source, isSession) {
+  function bind(source, isSession, canonicalClay) {
     if (!source || typeof source.projectSlug !== "string") return null;
     var initialSlug = source.projectSlug;
     var initialProject = projectFor(initialSlug);
     var initialSession = isSession ? source.session : null;
+    var clayInitial;
+    if (canonicalClay) { try { clayInitial = require("./canonical-clay-record-authority").resolve(source.authority, initialSlug); } catch (error) { return null; } }
     if (!initialProject || (isSession && !initialSession)) return null;
     if (initialSession) provenance.ensureOrigin(initialSession);
-    var initialUserId = initialSession ? initialSession.ownerId || null : source.userId || null;
+    var initialUserId = initialSession ? initialSession.ownerId || null : canonicalClay ? clayInitial.principal.userId || clayInitial.principal.singleUserOwnerId : source.userId || null;
     var initialOrigin = initialSession ? initialSession.sessionOriginId || null : null;
     var initial = bindingState(initialProject, initialSession, initialUserId, initialOrigin);
     if (!initial) return null;
 
     function current() {
       if (projectFor(initialSlug) !== initialProject) throw new Error("This Issues binding is no longer valid.");
+      if (canonicalClay) {
+        var clayLive = require("./canonical-clay-record-authority").resolve(source.authority, initialSlug);
+        if (clayLive.project !== initialProject || clayLive.status.path !== clayInitial.status.path || clayLive.status.projectKnowledgeId !== clayInitial.status.projectKnowledgeId || clayLive.status.changeSetId !== clayInitial.status.changeSetId) throw new Error("Selected Issues context changed.");
+      }
       var live = bindingState(initialProject, initialSession, initialUserId, initialOrigin);
       if (!live) throw new Error("This Issues binding is no longer valid.");
       return live;
     }
 
+    function expected(entry, args) { if (canonicalClay && (!Number.isInteger(args.expectedRevision) || entry.revision !== args.expectedRevision)) throw new Error("Issue revision conflict."); }
+
+    function actor(state) { return canonicalClay ? require("./canonical-clay-record-authority").resolve(source.authority, initialSlug).actor : author(state.user, state.session ? "session" : "user", state.session); }
+
     function visibleIssue(store, ref, state) {
       var result = store.read(ref);
       if (state.worktreeOnly && (!result.context || result.context.changeSetId !== state.status.changeSetId)) throw new Error("Issue not found.");
@@ -174,7 +184,7 @@ function attachIssuesService(ctx) {
         path: state.status.path, knowledgeId: governing.projectKnowledgeId,
         changeSetId: state.status.changeSetId || null, worktreeOnly: state.worktreeOnly,
         recordContext: clone(issueContext(state.status)),
-        actor: clone(author(state.user, state.session ? "session" : "user", state.session)),
+        actor: clone(actor(state)),
         osIdentity: needsIdentity ? osIdentity(state) : null };
     }
 
@@ -184,7 +194,7 @@ function attachIssuesService(ctx) {
       var liveIdentity = needsIdentity ? osIdentity(fresh) : null;
       if (fresh.project !== before.project || fresh.session !== before.session || (fresh.user.id || null) !== before.userId ||
           fresh.status.path !== before.path || !governing || governing.projectKnowledgeId !== before.knowledgeId ||
-          (fresh.status.changeSetId || null) !== before.changeSetId || fresh.worktreeOnly !== before.worktreeOnly ||
+          (fresh.status.changeSetId || null) !== before.changeSetId || fresh.worktreeOnly !== before.worktreeOnly || JSON.stringify(issueContext(fresh.status)) !== JSON.stringify(before.recordContext) ||
           JSON.stringify(liveIdentity) !== JSON.stringify(before.osIdentity)) throw new Error("Issue authorization changed during the operation.");
       return fresh;
     }
@@ -200,7 +210,7 @@ function attachIssuesService(ctx) {
     var github = require('./issues-github').attachIssueGithub({
       locks: githubLocks, assessments: githubAssessments, run: context.runGithub, analyze: source.analyzeGithub || context.analyzeGithub,
       begin: function () {
-        if (isSession) throw new Error('GitHub filing requires an explicit action in the Issues panel.');
+        if (isSession || canonicalClay) throw new Error('GitHub filing requires an explicit action in the Issues panel.');
         return operation(current(), true);
       },
       read: function (before, ref) {
@@ -217,6 +227,7 @@ function attachIssuesService(ctx) {
     return {
       searchGithubIssue: github.search, linkGithubIssue: github.link, createGithubIssue: github.create,
       linkWorkSession: function (args, session) {
+        if (canonicalClay) throw new Error("Use reviewed project assignment or follow-up for Driver execution.");
         var state = current();
         var manager = state.project.getSessionManager();
         if (!args || !Number.isInteger(args.expectedRevision)) throw new Error("expectedRevision is required.");
@@ -232,9 +243,10 @@ function attachIssuesService(ctx) {
         if (links.some(function (link) { return link.sessionId === session.sessionOriginId; })) return entry;
         var link = { sessionId: session.sessionOriginId, role: "driver", issueRevision: args.expectedRevision };
         if (args.requestId !== undefined) link.requestId = schema.text(args.requestId, "work request id", 200, true);
-        return target.update(args.ref, { linkedWorkSessions: links.concat([link]), status: "in_progress" }, args.expectedRevision, author(state.user, "user", null));
+        return target.update(args.ref, { linkedWorkSessions: links.concat([link]), status: "in_progress" }, args.expectedRevision, canonicalClay ? actor(state) : author(state.user, "user", null));
       },
       resolveWorkSession: function (args) {
+        if (canonicalClay) throw new Error("Work sessions require the existing project Driver workflow.");
         var state = current();
         var entry = visibleIssue(openStore(state.status), args.ref, state);
         if (!(entry.linkedWorkSessions || []).some(function (link) { return link.sessionId === args.sessionOriginId; })) throw new Error("Work session unavailable.");
@@ -255,9 +267,9 @@ function attachIssuesService(ctx) {
       readIssueTombstone: function (args) { var state = current(); return scopedIssue(openStore(state.status), args && args.ref, state); },
       issueHistory: function (args) { var state = current(); var store = openStore(state.status); var history = store.history(args && args.ref); if (state.worktreeOnly) { var historical = scopedIssue(store, args && args.ref, state); if (!historical.context || historical.context.changeSetId !== state.status.changeSetId) throw new Error("Issue not found."); } return history; },
       readIssueRevision: function (args) { var state = current(); var store = openStore(state.status); visibleIssue(store, args && args.ref, state); return store.readRevision(args.ref, args.revision); },
-      commentIssue: function (args) { var state = current(); var target = openStore(state.status); visibleIssue(target, args && args.ref, state); return target.comment(args.ref, args.body, author(state.user, "user", null)); },
+      commentIssue: function (args) { var state = current(); var target = openStore(state.status); expected(visibleIssue(target, args && args.ref, state), args); return target.comment(args.ref, args.body, canonicalClay ? actor(state) : author(state.user, "user", null)); },
       listIssueFeedback: function (args) {
-        if (!isSession) throw new Error("Only the Project Driver can review issue comments.");
+        if (!isSession && !canonicalClay) throw new Error("Only the Project Driver can review issue comments.");
         var state = current(); var target = openStore(state.status); var out = []; var feedbackLimit = args && args.limit === undefined ? 200 : Number(args.limit);
         if (!Number.isInteger(feedbackLimit) || feedbackLimit < 1 || feedbackLimit > 200) throw new Error("Feedback limit must be between 1 and 200.");
         var position = { issueCursor: null, issueIndex: 0, commentOffset: 0 };
@@ -297,31 +309,32 @@ function attachIssuesService(ctx) {
         return { feedback: out, total: out.length, nextCursor: nextCursor, truncated: !!nextCursor };
       },
       reviewIssueComment: function (args) {
-        if (!isSession) throw new Error("Only the Project Driver can review issue comments.");
+        if (!isSession && !canonicalClay) throw new Error("Only the Project Driver can review issue comments.");
         var state = current(); var target = openStore(state.status); var entry = visibleIssue(target, args && args.ref, state);
+        expected(entry, args);
         if (args.action === "incorporate") {
           if (!Number.isInteger(args.expectedRevision)) throw new Error("expectedRevision is required to incorporate a comment.");
           var data = cleanPublic(args, { ref: true, expectedRevision: true, commentId: true, action: true, response: true, commitSha: true }, true);
           if (data.status === "resolved") throw new Error("Use update_issue with verified commit evidence before resolving this Issue.");
-          return target.incorporate(entry.ref, args.commentId, data, args.expectedRevision, args.response, author(state.user, "session", state.session));
+          return target.incorporate(entry.ref, args.commentId, data, args.expectedRevision, args.response, actor(state));
         }
-        return target.review(entry.ref, args.commentId, args.action, args.response, author(state.user, "session", state.session));
+        return target.review(entry.ref, args.commentId, args.action, args.response, actor(state));
       },
       removeIssue: function (args) {
         var state = current();
         if (!state.principal.isProjectOwner) throw new Error("Only the project owner can delete Issues.");
         var target = openStore(state.status); var entry = visibleIssue(target, args && args.ref, state);
         if (!Number.isInteger(args && args.expectedRevision) || entry.revision !== args.expectedRevision) throw new Error("Issue revision conflict.");
-        return target.remove(entry.ref, author(state.user, "user", null), args.expectedRevision);
+        return target.remove(entry.ref, canonicalClay ? actor(state) : author(state.user, "user", null), args.expectedRevision);
       },
       createIssue: function (args) {
-        if (!isSession) throw new Error("People cannot create issues directly. Ask the Project Driver to create one.");
+        if (!isSession && !canonicalClay) throw new Error("People cannot create issues directly. Ask the Project Driver to create one.");
         var data = cleanPublic(args, { commitSha: true }, true);
         var status = data.status === undefined ? "open" : data.status;
         if (schema.STATUSES.indexOf(status) === -1) throw new Error("Invalid status.");
         var state = current();
         if (status !== "resolved") return Promise.resolve(openStore(state.status).create(data,
-          author(state.user, state.session ? "session" : "user", state.session), issueContext(state.status)));
+          actor(state), issueContext(state.status)));
         if (typeof data.resolutionSummary !== "string" || !data.resolutionSummary.trim()) throw new Error("resolutionSummary is required when resolving an issue.");
         var before = operation(state, true);
         return evidence(before, args.commitSha).then(function (proof) {
@@ -340,7 +353,7 @@ function attachIssuesService(ctx) {
         var existing = visibleIssue(target, ref, state);
         if (existing.revision !== expectedRevision) throw new Error("Issue revision conflict.");
         if (data.status !== "resolved") return Promise.resolve(target.update(ref, data, expectedRevision,
-          author(state.user, state.session ? "session" : "user", state.session)));
+          actor(state)));
         if (typeof data.resolutionSummary !== "string" || !data.resolutionSummary.trim()) throw new Error("resolutionSummary is required when resolving an issue.");
         var before = operation(state, true);
         return evidence(before, args.commitSha).then(function (proof) {
@@ -354,6 +367,7 @@ function attachIssuesService(ctx) {
   }
 
   return { bindUser: function (source) { return bind(source, false); },
+    bindCanonicalClay: function (source) { return bind(source, false, true); },
     bindProjectSession: function (source) { return bind(source, true); },
     issueScopeIdForKnowledgeId: issuesStore.issueScopeIdForKnowledgeId };
 }

package/lib/knowledge-db-import.js

@@ -38,9 +38,10 @@ function attachKnowledgeDbImport(ctx) {
   }
   function importRecords(args) {
     // Snapshot caller-owned JSON before any asynchronous operation.
-    var batch = ctx.clone(input.batch(args)); args = ctx.clone(args);
+    var revalidate = args.revalidate; var batch = ctx.clone(input.batch(args)); args = ctx.clone(args); args.revalidate = revalidate;
     var operationId = ctx.mutationId(args.operationId); var fingerprint = ctx.fingerprint("import", args);
     return ctx.serialize(args.databaseId, function () { return ctx.load(args.databaseId).then(async function (current) {
+      ctx.guard(args, current);
       var duplicate = ctx.receipt(current, operationId, fingerprint);
       if (duplicate) return Object.assign({}, duplicate, { projectionPending: current.projectionPending === true, projectionError: current.projectionError || null });
       if (current.archivedAt) throw ctx.error("Knowledge database is archived.", "ARCHIVED", current.revision);
@@ -60,10 +61,10 @@ function attachKnowledgeDbImport(ctx) {
       // payload still conflicts. Preserve record values, archives and database revision.
       if (!added.length) {
         ctx.remember(next, operationId, fingerprint, result);
-        await ctx.replace(current, next);
+        await ctx.replace(current, next, args);
         return Object.assign(result, { projectionPending: current.projectionPending === true, projectionError: current.projectionError || null });
       }
-      var databases = await ctx.all(); var at = Date.now(); var who = ctx.actor(args.actor);
+      var databases = await ctx.all(); ctx.guard(args, current); var at = Date.now(); var who = ctx.actor(args.actor);
       added.forEach(function (item) {
         next.records.push({ id: item.mapping.recordId, revision: 1, values: {}, archivedAt: null, createdAt: at, updatedAt: at, createdBy: who, updatedBy: who });
         next.recordHistory[item.mapping.recordId] = [];
@@ -78,7 +79,7 @@ function attachKnowledgeDbImport(ctx) {
       next.revision++; next.updatedAt = at; next.updatedBy = who; next.projectionPending = true; next.projectionError = null;
       result.databaseRevision = next.revision;
       ctx.remember(next, operationId, fingerprint, result);
-      await ctx.replace(current, next);
+      await ctx.replace(current, next, args);
       return ctx.finish(next, result, who);
     }); });
   }