clay-server 5.2.0-beta.4 → 5.2.0-beta.6

package/lib/project-sessions.js

@@ -2,7 +2,7 @@ var serverSettingsMessages = require("./project-server-settings");
 var fs = require("fs");
 var path = require("path");
 var { execFileSync } = require("child_process");
-var { CODEX_DEFAULTS, getCodexConfig } = require("./codex-defaults");
+var providerSettings = require("./yoke/settings");
 var updateSnooze = require("./update-snooze");
 var yoke = require("./yoke");
 var sessionVisibility = require("./session-visibility");
@@ -118,14 +118,20 @@ function attachSessions(ctx) {
   var ensureProjectAccessForSession = ctx.ensureProjectAccessForSession;
   var getOsUserInfoForWs = ctx.getOsUserInfoForWs;
   var hydrateSkillCatalog = ctx.hydrateSkillCatalog || function () { return []; };
+  var sessionActions = require("./project-session-actions").attachSessionActions(ctx);
+  var sessionVendor = require("./project-session-vendor").attachSessionVendor(ctx);
+  var sessionRuntime = require("./project-session-runtime-actions").attachSessionRuntimeActions({ sm: sm, tm: tm, prepareGui: prepareTuiSessionForGuiView, isPendingQueuePaused: ctx.isPendingQueuePaused,
+    publishGui: function (session) {
+      clients.forEach(function (ws) {
+        if (ws.readyState !== 1 || ws._clayActiveSession !== session.localId) return;
+        if (usersModule.isMultiUser() && (!ws._clayUser || !usersModule.findUserById(ws._clayUser.id) || !usersModule.canAccessProject(ws._clayUser.id, getProjectAccess()) || !usersModule.canAccessSession(ws._clayUser.id, session, getProjectAccess()))) return;
+        sm.switchSession(session.localId, ws, ctx.hydrateImageRefs);
+      });
+    },
+  });
   function stopSession(session, actor) {
     if (!session) return false;
-    session._pendingMessageDrainPaused = true;
-    if (typeof ctx.onPendingQueuePause === "function") ctx.onPendingQueuePause(session, actor || null);
-    if (!session.isProcessing && !session._queryStarting) return true;
-    if (typeof ctx.onHumanPairStop === "function") ctx.onHumanPairStop(session);
-    session.taskStopRequested = true;
-    if (session.abortController) session.abortController.abort();
+    sessionActions.stop(session, actor);
     return true;
   }
   var hydrateImageRefs = ctx.hydrateImageRefs;
@@ -149,9 +155,9 @@ function attachSessions(ctx) {
     var answers = msg.answers || {};
     var pending = session.pendingAskUser && session.pendingAskUser[toolId];
     if (!pending) return false;
-    if (pending.request && pending.request.source === "mcp-import" &&
+    if (pending.request && ["mcp-import", "product-control"].indexOf(pending.request.source) >= 0 &&
         (typeof pending.request.authorizeResponse !== "function" || !pending.request.authorizeResponse(ws))) return false;
-    if (pending.request && pending.request.source === "work-primary" && usersModule.isMultiUser() &&
+    if (pending.request && ["work-primary", "mate-schedule"].indexOf(pending.request.source) >= 0 && usersModule.isMultiUser() &&
         (!ws || !ws._clayUser || ws._clayUser.id !== session.ownerId)) return false;
     if (pending.mode === "yoke") {
       try { yoke.userInput.normalizeAnswers(pending.request.questions, answers); }
@@ -213,6 +219,10 @@ function attachSessions(ctx) {
   var setLatestVersion = ctx.setLatestVersion;
   var loadContextSources = ctx.loadContextSources;
 
+  var sessionHistory = require("./project-session-history-actions").attachSessionHistoryActions(Object.assign({}, ctx, {
+    resolveSessionHome: resolveSessionHome, cancelPendingAskUser: cancelPendingAskUser,
+  }));
+
   function canAccessProjectSlug(ws, targetSlug) {
     if (!targetSlug) return false;
     if (!usersModule || typeof usersModule.isMultiUser !== "function" || !usersModule.isMultiUser()) return true;
@@ -248,7 +258,7 @@ function attachSessions(ctx) {
     if (!session || !session.cliSessionId) return;
     if (session._titleWatcherStop) return; // already watching
     var watcher;
-    try { watcher = require("./claude-jsonl-watcher"); } catch (e) { return; }
+    try { watcher = require("./yoke/claude-jsonl-watcher"); } catch (e) { return; }
     var home = resolveSessionHome(session);
     var jsonlPath = watcher.jsonlPathFor(home, cwd, session.cliSessionId);
     if (!jsonlPath) return;
@@ -316,7 +326,7 @@ function attachSessions(ctx) {
         // message right away. The transcript is small enough that a full
         // re-send beats maintaining a delta protocol.
         try {
-          var newIndex = require("./tui-transcript-index").readAssistantIndex(resolveSessionHome(s), cwd, s.cliSessionId);
+          var newIndex = require("./yoke/tui-transcript-index").readAssistantIndex(resolveSessionHome(s), cwd, s.cliSessionId);
           send({
             type: "tui_transcript_state",
             id: s.localId,
@@ -440,10 +450,10 @@ function attachSessions(ctx) {
   // Idempotent: if the PTY is already gone and history is populated, this
   // is a no-op (avoids re-reading jsonl and re-writing the session file on
   // every click while the user is reading the session in GUI mode).
-  function prepareTuiSessionForGuiView(session) {
+  function prepareTuiSessionForGuiView(session, options) {
     if (!session || session.cliSessionId == null) return;
     var cliSess;
-    try { cliSess = require("./cli-sessions"); } catch (e) { return; }
+    try { cliSess = require("./yoke/cli-sessions"); } catch (e) { return; }
     // Re-read whenever the jsonl has changed since the last hydrate (a TUI
     // turn appended messages), not just when history is empty. The earlier
     // "already hydrated" short-circuit kept stale history after a
@@ -467,7 +477,7 @@ function attachSessions(ctx) {
       try { tm.close(session.terminalId); } catch (e) {}
     }
     session.terminalId = null;
-    try { sm.saveSessionFile(session); } catch (e) {}
+    if (!options || !options.deferSave) { try { sm.saveSessionFile(session); } catch (e) {} }
   }
 
   // Resolve how a session should be presented to a viewer WITHOUT spawning a
@@ -593,7 +603,7 @@ function attachSessions(ctx) {
       var from = sm.findTurnBoundary(session.history, Math.max(0, targetFrom));
       var to = before;
       var items = session.history.slice(from, to).map(function (item, index) {
-        return Object.assign({}, hydrateImageRefs(item), { _historyIndex: from + index });
+        return Object.assign({}, hydrateImageRefs(require("./yoke/usage").clientEvent(item, session.vendor || "claude")), { _historyIndex: from + index });
       });
       sendTo(ws, {
         type: "history_prepend",
@@ -768,11 +778,10 @@ function attachSessions(ctx) {
         sendTo(ws, { type: "error", text: "Cannot transfer ownership of home directory projects." });
         return true;
       }
-      var projectOwnerId = getProjectOwnerId();
-      var isAdmin = ws._clayUser && ws._clayUser.role === "admin";
+      var projectOwnerId = getProjectAccess().ownerId;
       var isProjectOwner = ws._clayUser && projectOwnerId && ws._clayUser.id === projectOwnerId;
-      if (!ws._clayUser || (!isAdmin && !isProjectOwner)) {
-        sendTo(ws, { type: "error", text: "Only project owners or admins can transfer ownership." });
+      if (!ws._clayUser || !isProjectOwner) {
+        sendTo(ws, { type: "error", text: "Only project owners can transfer ownership." });
         return true;
       }
       var targetUser = msg.userId ? usersModule.findUserById(msg.userId) : null;
@@ -780,11 +789,11 @@ function attachSessions(ctx) {
         sendTo(ws, { type: "error", text: "User not found." });
         return true;
       }
+      // Persist before publishing runtime ownership.
+      if (!opts.onProjectOwnerChanged) return true;
+      var savedOwner = opts.onProjectOwnerChanged(slug, targetUser.id);
+      if (savedOwner && savedOwner.error) { sendTo(ws, { type: "error", text: savedOwner.error }); return true; }
       setProjectOwnerId(targetUser.id);
-      // Persist via daemon callback
-      if (opts.onProjectOwnerChanged) {
-        opts.onProjectOwnerChanged(slug, targetUser.id);
-      }
       send({ type: "project_owner_changed", ownerId: targetUser.id, ownerName: targetUser.displayName || targetUser.username });
       return true;
     }
@@ -801,6 +810,7 @@ function attachSessions(ctx) {
         // broadcasts session_switched. A live runtime keeps its actual mode
         // for every viewer; idle sessions open in chat. Nothing is spawned here.
         var xmTarget = sm.sessions.get(msg.id);
+        if (usersModule.isMultiUser() && (!ws._clayUser || !usersModule.canAccessSession(ws._clayUser.id, xmTarget, getProjectAccess()))) return true;
         if (xmTarget && (!xmTarget.vendor || vendorSupportsTui(xmTarget.vendor))) {
           // Single source of truth: live runtime wins (tui stays tui, gui stays
           // gui); idle legacy sessions hydrate their transcript into chat.
@@ -908,7 +918,7 @@ function attachSessions(ctx) {
         return true;
       }
       try {
-        var tprIndex = require("./tui-transcript-index").readAssistantIndex(resolveSessionHome(tprSess), cwd, tprSess.cliSessionId);
+        var tprIndex = require("./yoke/tui-transcript-index").readAssistantIndex(resolveSessionHome(tprSess), cwd, tprSess.cliSessionId);
         sendTo(ws, {
           type: "tui_transcript_state",
           id: tprId,
@@ -939,19 +949,7 @@ function attachSessions(ctx) {
         var s = sm.sessions.get(msg.id);
         if (usersModule.isMultiUser() && (!ws._clayUser ||
             !usersModule.canAccessSession(ws._clayUser.id, s, getProjectAccess()))) return true;
-        s.title = String(msg.title).substring(0, 100);
-        s.titleProvisional = false;
-        s.titleAutoGenerated = false;
-        s.titleManuallySet = true;
-        sm.saveSessionFile(s);
-        sm.notifySessionRenamed(s.localId);
-        sm.broadcastSessionList();
-        // Sync title to SDK session
-        if (s.cliSessionId) {
-          adapter.renameSession(s.cliSessionId, s.title, { dir: cwd }).catch(function(e) {
-            console.error("[project] SDK renameSession failed:", e.message);
-          });
-        }
+        sessionActions.rename(s, String(msg.title).substring(0, 100));
       }
       return true;
     }
@@ -1086,7 +1084,6 @@ function attachSessions(ctx) {
 
     if (msg.type === "stop") {
       var session = getSessionForWs(ws);
-      if (autonomousRun && session && session.autonomousRun) autonomousRun.finish(session, "stopped", "Stopped by the user.");
       stopSession(session, ws && ws._clayUser);
       return true;
     }
@@ -1102,14 +1099,14 @@ function attachSessions(ctx) {
       var pid = msg.pid;
       if (!pid || typeof pid !== "number") return true;
       // Verify target is actually a claude process before killing
-      if (!sdk.isClaudeProcess(pid)) {
-        console.error("[project] Refused to kill PID " + pid + ": not a claude process");
-        sendTo(ws, { type: "error", text: "Process " + pid + " is not a Claude process." });
+      if (!sdk.isProviderProcess(pid, getSessionForWs(ws))) {
+        console.error("[project] Refused to kill PID " + pid + ": not a verified provider process");
+        sendTo(ws, { type: "error", text: "Process " + pid + " is not a verified provider process." });
         return true;
       }
       try {
         process.kill(pid, "SIGTERM");
-        console.log("[project] Sent SIGTERM to conflicting Claude process PID " + pid);
+        console.log("[project] Sent SIGTERM to conflicting provider process PID " + pid);
         sendTo(ws, { type: "process_killed", pid: pid });
       } catch (e) {
         console.error("[project] Failed to kill PID " + pid + ":", e.message);
@@ -1187,38 +1184,14 @@ function attachSessions(ctx) {
 
     if (msg.type === "set_vendor" && msg.vendor) {
       var vendorSession = getSessionForWs(ws);
-      if (vendorSession) {
-        // Refuse to rebind vendor on a session that is already bound to a
-        // different CLI (cliSessionId is vendor-specific). This prevents a
-        // stale client-side vendor state from clobbering the persisted vendor
-        // on page reload / server restart.
-        var alreadyBound = vendorSession.cliSessionId && vendorSession.vendor && vendorSession.vendor !== msg.vendor;
-        if (alreadyBound) {
-          console.warn("[project] set_vendor ignored: session " + vendorSession.localId +
-            " is bound to '" + vendorSession.vendor + "', refused rebind to '" + msg.vendor + "'");
-        } else {
-          vendorSession.vendor = msg.vendor;
-          if (vendorSession.permissionMode === "auto" && msg.vendor !== "claude") {
-            vendorSession.permissionMode = "default";
-            vendorSession.effectivePermissionMode = null;
-          }
-          if (vendorSession.vendor !== msg.vendor) vendorSession.model = "";
-          sm.saveSessionFile(vendorSession);
-          sm.broadcastSessionList();
-        }
-      }
-      if (msg.vendor) {
-        var vendorModels = (sm.modelsByVendor && sm.modelsByVendor[msg.vendor]) || [];
-        sendTo(ws, {
-          type: "model_info",
-          model: "",
-          models: vendorModels,
-          vendor: msg.vendor, sessionId: vendorSession ? vendorSession.localId : null,
-          availableVendors: sm.availableVendors || [],
-          installedVendors: sm.installedVendors || [],
-        });
-        send({ type: "config_state", vendor: null, sessionId: null, mode: sm.currentPermissionMode || "default", effort: sm.currentEffort || "medium", betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
+      if (!vendorSession) return true;
+      // Re-selecting the provider of an established thread does not rebind it.
+      if (vendorSession.cliSessionId && vendorSession.vendor === msg.vendor) return true;
+      try {
+        var vendorResult = sessionVendor.setVendor(vendorSession, msg.vendor);
+        if (vendorResult.status === "failed") sendTo(ws, { type: "error", text: vendorResult.error });
       }
+      catch (error) { sendTo(ws, { type: "error", text: error.message }); }
       return true;
     }
 
@@ -1286,15 +1259,7 @@ function attachSessions(ctx) {
       if (!valid.ok) { permissionResult(false, valid.error, true); return true; }
       (async function() {
         try {
-          if (session.permissionMode === "bypassPermissions" && valid.mode !== "bypassPermissions" && autonomousRun) {
-            await autonomousRun.stopForPermissionChange(session);
-          }
-          await fullAccessService.setMode(session, valid.mode);
-          var state = permissionModes.clientState(session, sm.currentPermissionMode, sm.defaultVendor);
-          sm.sendToSession(session, { type: "config_state", sessionId: session.localId, vendor: session.vendor || sm.defaultVendor || "claude", mode: state.requestedPermissionMode,
-            effectivePermissionMode: state.effectivePermissionMode, permissionRequestId: requestId,
-            permissionCapabilities: state.permissionCapabilities, mcpPermissionModeOverrides: state.mcpPermissionModeOverrides,
-            effort: session.effort || sm.currentEffort || "medium", betas: sm.currentBetas || [] });
+          await sessionActions.permission(session, valid.mode, requestId);
           permissionResult(true, null, true);
         } catch (error) {
           permissionResult(false, "Failed to change permission mode: " + (error.message || error), true);
@@ -1364,10 +1329,9 @@ function attachSessions(ctx) {
           sendTo(ws, { type: "error", text: "This effort level is not supported by the selected vendor." });
           return true;
         }
-        sdk.setEffort(session, sessionEffort).catch(function (e) {
+        sessionActions.effort(session, sessionEffort).catch(function (e) {
           sendTo(ws, { type: "error", text: "Failed to change reasoning effort: " + (e.message || e) });
         });
-        sm.sendToSession(session, { type: "config_state", model: session.model || ((sm.defaultModelByVendor || {})[effortVendor]) || "", vendor: effortVendor, sessionId: session.localId, mode: session.permissionMode || sm.currentPermissionMode || "default", effort: sessionEffort, betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
       }
       return true;
     }
@@ -1403,20 +1367,12 @@ function attachSessions(ctx) {
       return true;
     }
 
-    // Codex-specific settings (stored on sessionManager, passed to adapter via adapterOptions)
-    if (msg.type === "set_codex_approval") {
-      sm.codexApproval = getCodexConfig({ codexApproval: msg.approval }).approval;
-      send(Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
-      return true;
-    }
-    if (msg.type === "set_codex_sandbox") {
-      sm.codexSandbox = msg.sandbox || CODEX_DEFAULTS.sandbox;
-      send(Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
-      return true;
-    }
-    if (msg.type === "set_codex_websearch") {
-      sm.codexWebSearch = msg.webSearch || CODEX_DEFAULTS.webSearch;
-      send(Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
+    var providerChange;
+    try { providerChange = providerSettings.change(msg, sm); }
+    catch (error) { sendTo(ws, { type: "error", text: error.message }); return true; }
+    if (providerChange) {
+      Object.keys(providerChange.patch).forEach(function(key) { sm[key] = providerChange.patch[key]; });
+      providerChange.messages.forEach(function(message) { send(message); });
       return true;
     }
 
@@ -1444,92 +1400,9 @@ function attachSessions(ctx) {
         sendTo(ws, { type: "rewind_error", text: "Rewind already in progress." });
         return true;
       }
-      session._rewindInProgress = true;
-      var mode = msg.mode || "both";
-
-      (async function () {
-        try {
-          // File restoration (delegated to adapter via sdk-bridge)
-          if (mode !== "chat") {
-            await sdk.rewindExecuteFiles(session, msg.uuid);
-          }
-
-          // Conversation rollback (skip for files-only mode)
-          if (mode !== "files") {
-            var targetIdx = -1;
-            for (var i = 0; i < session.messageUUIDs.length; i++) {
-              if (session.messageUUIDs[i].uuid === msg.uuid) {
-                targetIdx = i;
-                break;
-              }
-            }
-
-            // Codex's thread/revert cuts at a turn id, not a count. Read the
-            // target entry's turnId BEFORE trimming local history below.
-            var hasTurnsToRollBack = false;
-            var targetTurnId = null;
-            if (targetIdx >= 0) {
-              targetTurnId = session.messageUUIDs[targetIdx].turnId || null;
-              for (var ri = targetIdx; ri < session.messageUUIDs.length; ri++) {
-                if (session.messageUUIDs[ri].type === "user") { hasTurnsToRollBack = true; break; }
-              }
-            }
-
-            // Notify adapter of conversation rollback (e.g. Codex thread/revert)
-            // BEFORE trimming local history below. Deliberately not caught
-            // here: a failed or impossible (missing turnId) provider-side
-            // rollback must abort the whole rewind via the outer catch, never
-            // leave local history trimmed ahead of the real provider thread.
-            if (hasTurnsToRollBack) {
-              await sdk.rollbackConversation(session, targetTurnId);
-            }
-
-            if (targetIdx >= 0) {
-              var trimTo = session.messageUUIDs[targetIdx].historyIndex;
-              for (var k = trimTo - 1; k >= 0; k--) {
-                if (session.history[k].type === "user_message") {
-                  trimTo = k;
-                  break;
-                }
-              }
-              session.history = session.history.slice(0, trimTo);
-              session.messageUUIDs = session.messageUUIDs.slice(0, targetIdx);
-              // Reset digest checkpoint if it points past the trimmed history
-              if (typeof session._dmLastDigestedIndex === "number" && session._dmLastDigestedIndex > trimTo) {
-                session._dmLastDigestedIndex = trimTo;
-              }
-            }
-
-            var kept = session.messageUUIDs;
-            session.lastRewindUuid = kept.length > 0 ? kept[kept.length - 1].uuid : null;
-          }
-
-          if (session.abortController) {
-            try { session.abortController.abort(); } catch (e) {}
-          }
-          if (session.messageQueue) {
-            try { session.messageQueue.end(); } catch (e) {}
-          }
-          session.queryInstance = null;
-          session.messageQueue = null;
-          session.abortController = null;
-          session.blocks = {};
-          session.sentToolResults = {};
-          session.pendingPermissions = {};
-          cancelPendingAskUser(session, "Conversation rewound");
-          session.isProcessing = false;
-          onProcessingChanged();
-
-          sm.saveSessionFile(session);
-          sm.switchSession(session.localId, ws, hydrateImageRefs);
-          sm.sendAndRecord(session, { type: "rewind_complete", mode: mode });
-          sm.broadcastSessionList();
-        } catch (err) {
-          sendTo(ws, { type: "rewind_error", text: "Rewind failed: " + err.message });
-        } finally {
-          session._rewindInProgress = false;
-        }
-      })();
+      sessionHistory.rewind(session, msg.uuid, msg.mode || "both", ws, function () {}).catch(function (error) {
+        sendTo(ws, { type: "rewind_error", text: "Rewind failed: " + error.message });
+      });
       return true;
     }
 
@@ -1539,62 +1412,10 @@ function attachSessions(ctx) {
         sendTo(ws, { type: "error", text: "Cannot fork: no CLI session" });
         return true;
       }
-      var forkTitle = (session.title || "New Session") + " (fork)";
-
-      sdk.forkSession(session, msg.uuid).then(function(result) {
-        if (result.useLocalHistory) {
-          // Copy local history up to the target UUID
-          var targetIdx = -1;
-          for (var fi = 0; fi < session.messageUUIDs.length; fi++) {
-            if (session.messageUUIDs[fi].uuid === msg.uuid) { targetIdx = fi; break; }
-          }
-          var forkHistory = [];
-          if (targetIdx >= 0) {
-            var trimTo = session.messageUUIDs[targetIdx].historyIndex;
-            forkHistory = session.history.slice(0, trimTo);
-          } else {
-            forkHistory = session.history.slice();
-          }
-          var forked = sm.createSession({
-            vendor: session.vendor,
-            ownerId: session.ownerId || null,
-            userKnowledgeOwnerId: session.userKnowledgeOwnerId || null,
-            sessionVisibility: sessionVisibility.normalize(session.sessionVisibility),
-          }, ws);
-          forked.cliSessionId = result.sessionId;
-          forked.title = forkTitle;
-          forked.history = forkHistory;
-          forked.messageUUIDs = [];
-          for (var hi = 0; hi < forkHistory.length; hi++) {
-            if (forkHistory[hi].type === "message_uuid") {
-              forked.messageUUIDs.push({ uuid: forkHistory[hi].uuid, type: forkHistory[hi].messageType, historyIndex: hi, turnId: forkHistory[hi].turnId || null });
-            }
-          }
-          sm.saveSessionFile(forked);
-          sm.switchSession(forked.localId, ws, hydrateImageRefs);
-          sendTo(ws, { type: "fork_complete", sessionId: forked.localId });
-          sm.broadcastSessionList();
-        } else {
-          // Read history from CLI session files
-          var cliSess = require("./cli-sessions");
-          return cliSess.readCliSessionHistory(resolveSessionHome(session), cwd, result.sessionId).then(function(history) {
-            var forked = sm.resumeSession(result.sessionId, {
-              history: history,
-              title: forkTitle,
-              vendor: session.vendor,
-              ownerId: session.ownerId || null,
-              userKnowledgeOwnerId: session.userKnowledgeOwnerId || null,
-              sessionVisibility: sessionVisibility.normalize(session.sessionVisibility),
-              sessionVisibilityExplicit: session.sessionVisibilityExplicit === true,
-            }, ws);
-            if (forked) {
-              ws._clayActiveSession = forked.localId;
-              sendTo(ws, { type: "fork_complete", sessionId: forked.localId });
-            }
-          });
-        }
-      }).catch(function(e) {
-        sendTo(ws, { type: "error", text: "Fork failed: " + (e.message || e) });
+      sessionHistory.fork(session, msg.uuid, ws, function () {}).then(function (forked) {
+        if (forked) sendTo(ws, { type: "fork_complete", sessionId: forked.localId });
+      }).catch(function (error) {
+        sendTo(ws, { type: "error", text: "Fork failed: " + error.message });
       });
       return true;
     }
@@ -1809,14 +1630,6 @@ function attachSessions(ctx) {
     if (msg.type === "browse_dir") {
       var rawPath = (msg.path || "").replace(/^~/, require("./config").REAL_HOME);
       var absTarget = path.resolve(rawPath);
-      // Multi-user mode: non-admins can only browse their home directory
-      if (osUsers && osUsers.length > 0 && ws._clayUser && ws._clayUser.role !== "admin") {
-        var browseHome = ws._clayUser.linuxUser ? "/home/" + ws._clayUser.linuxUser : null;
-        if (!browseHome || (absTarget !== browseHome && (absTarget + "/").indexOf(browseHome + "/") !== 0)) {
-          sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: [], error: "Access restricted to your home directory" });
-          return true;
-        }
-      }
       var parentDir, prefix;
       try {
         var stat = fs.statSync(absTarget);
@@ -1833,12 +1646,17 @@ function attachSessions(ctx) {
         parentDir = path.dirname(absTarget);
         prefix = path.basename(absTarget).toLowerCase();
       }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, parentDir)) {
+        sendTo(ws, { type: "browse_dir_result", entries: [], error: "Directory access is not permitted" });
+        return true;
+      }
       try {
         var dirItems = fs.readdirSync(parentDir, { withFileTypes: true });
         var dirEntries = [];
         for (var di = 0; di < dirItems.length; di++) {
           var d = dirItems[di];
           if (!d.isDirectory()) continue;
+          if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, path.join(parentDir, d.name))) continue;
           if (d.name.charAt(0) === ".") continue;
           if (IGNORED_DIRS.has(d.name)) continue;
           if (prefix && !d.name.toLowerCase().startsWith(prefix)) continue;
@@ -1856,17 +1674,9 @@ function attachSessions(ctx) {
     if (msg.type === "add_project") {
       var addPath = (msg.path || "").replace(/^~/, require("./config").REAL_HOME);
       var addAbs = path.resolve(addPath);
-      // Multi-user mode: normal users restricted to their home directory
-      if (osUsers && osUsers.length > 0 && ws._clayUser && ws._clayUser.role !== "admin") {
-        if (!ws._clayUser.linuxUser) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "No Linux user assigned" });
-          return true;
-        }
-        var userHome = "/home/" + ws._clayUser.linuxUser;
-        if (addAbs !== userHome && (addAbs + "/").indexOf(userHome + "/") !== 0) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "Path not allowed. You can only add directories under " + userHome });
-          return true;
-        }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, addAbs)) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Directory access is not permitted" });
+        return true;
       }
       try {
         var addStat = fs.statSync(addAbs);
@@ -1880,7 +1690,7 @@ function attachSessions(ctx) {
       }
       if (typeof opts.onAddProject === "function") {
         var result = opts.onAddProject(addAbs, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: result.ok, slug: result.slug, error: result.error, existing: result.existing });
+        sendTo(ws, Object.assign({}, result, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }
@@ -1905,7 +1715,7 @@ function attachSessions(ctx) {
       }
       if (typeof opts.onCreateProject === "function") {
         var createResult = opts.onCreateProject(createName, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: createResult.ok, slug: createResult.slug, error: createResult.error });
+        sendTo(ws, Object.assign({}, createResult, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }
@@ -1995,10 +1805,10 @@ function attachSessions(ctx) {
         moveAllSchedulesToProject(removeSlug, msg.moveTasksTo);
       }
       if (typeof opts.onRemoveProject === "function") {
-        // Send result before removing so the WS is still open
-        sendTo(ws, { type: "remove_project_result", ok: true, slug: removeSlug });
         var removeUserId = ws._clayUser ? ws._clayUser.id : null;
-        opts.onRemoveProject(removeSlug, removeUserId);
+        Promise.resolve().then(function () { return opts.onRemoveProject(removeSlug, removeUserId); }).then(function (result) {
+          sendTo(ws, { type: "remove_project_result", ok: !!result && result.ok === true, slug: removeSlug, error: result && result.error });
+        }, function (error) { sendTo(ws, { type: "remove_project_result", ok: false, slug: removeSlug, error: error.message }); });
       } else {
         sendTo(ws, { type: "remove_project_result", ok: false, error: "Not supported" });
       }
@@ -2044,7 +1854,7 @@ function attachSessions(ctx) {
       }
       if (typeof opts.onSetProjectTitle === "function") {
         var titleResult = opts.onSetProjectTitle(msg.slug, msg.title || null);
-        sendTo(ws, { type: "set_project_title_result", ok: titleResult.ok, slug: msg.slug, error: titleResult.error });
+        sendTo(ws, Object.assign({}, titleResult, { type: "set_project_title_result", slug: msg.slug }));
       } else {
         sendTo(ws, { type: "set_project_title_result", ok: false, error: "Not supported" });
       }
@@ -2106,7 +1916,7 @@ function attachSessions(ctx) {
       var galManaged = [];
       var galUser = [];
       try {
-        var galInstaller = require("./claude-hook-installer");
+        var galInstaller = require("./yoke/claude-hook-installer");
         galManaged = galInstaller.CLAY_MANAGED_ALLOW || [];
       } catch (e) {}
       if (galUid) {
@@ -2132,7 +1942,7 @@ function attachSessions(ctx) {
       // home (OS-mode: getent passwd; single-user: os.homedir()).
       var salEffective = false;
       try {
-        var salInstaller = require("./claude-hook-installer");
+        var salInstaller = require("./yoke/claude-hook-installer");
         var salHome = null;
         if (osUsers && ws._clayUser && ws._clayUser.linuxUser) {
           try {
@@ -2198,6 +2008,11 @@ function attachSessions(ctx) {
       return handleSessionsMessage(ws, { type: "permission_response", requestId: msg.requestId, decision: msg.decision });
     },
     stopHomeSession: stopSession,
+    sessionActions: sessionActions,
+    sessionHistoryActions: sessionHistory,
+    sessionVendorActions: sessionVendor,
+    sessionRuntimeActions: sessionRuntime,
+    deleteProductControlPlan: function (plan) { sessionDelete.executeOwnedDeletion(plan); },
   };
 }