clay-server 5.2.0-beta.4 → 5.2.0-beta.6

package/lib/sessions.js

@@ -3,7 +3,7 @@ var path = require("path");
 var config = require("./config");
 var utils = require("./utils");
 var users = require("./users");
-var { CODEX_DEFAULTS } = require("./codex-defaults");
+var providerDefaults = require("./yoke/settings").defaults();
 var hygiene = require("./session-hygiene");
 var backgroundTaskTiming = require("./background-task-timing");
 var sessionProvenance = require("./session-provenance");
@@ -39,16 +39,16 @@ function createSessionManager(opts) {
   var permissionRequestIndex = {}; // requestId -> sessionLocalId (O(1) lookup)
   var capabilitiesByVendor = null; // set by sdk-bridge after adapter init
   var defaultVendor = null;        // set by sdk-bridge
-  var codexApproval = CODEX_DEFAULTS.approval;
-  var codexSandbox = CODEX_DEFAULTS.sandbox;
-  var codexWebSearch = CODEX_DEFAULTS.webSearch;
+  var codexApproval = providerDefaults.codexApproval;
+  var codexSandbox = providerDefaults.codexSandbox;
+  var codexWebSearch = providerDefaults.codexWebSearch;
 
   // --- Session persistence (centralized in ~/.clay/sessions/{encoded-cwd}/) ---
   var sessionsBase = opts.sessionsBase || path.join(config.CONFIG_DIR, "sessions");
   var encodedCwd = utils.resolveEncodedDir(sessionsBase, cwd);
   var sessionsDir = path.join(sessionsBase, encodedCwd);
   fs.mkdirSync(sessionsDir, { recursive: true });
-  var cliSessionsDir = opts.cliSessionsDir || path.join(config.REAL_HOME, ".claude", "projects", utils.encodeCwd(cwd));
+  var cliSessionsDir = opts.cliSessionsDir || require("./yoke/legacy-sessions").directory(config.REAL_HOME, cwd);
   var deletedCliSessionsPath = path.join(sessionsDir, "deleted-cli-sessions.json");
   var deletedCliSessionIds = new Set();
   try {
@@ -77,29 +77,6 @@ function createSessionManager(opts) {
     }
   }
 
-  function readCliTranscriptHead(filePath) {
-    var MAX_READ = 64 * 1024;
-    try {
-      var stat = fs.statSync(filePath);
-      var fd = fs.openSync(filePath, "r");
-      var bytesToRead = Math.min(stat.size, MAX_READ);
-      var buf = Buffer.alloc(bytesToRead);
-      fs.readSync(fd, buf, 0, bytesToRead, 0);
-      fs.closeSync(fd);
-      var lines = buf.toString("utf8").split("\n");
-      var events = [];
-      for (var i = 0; i < lines.length; i++) {
-        if (!lines[i]) continue;
-        try {
-          var event = JSON.parse(lines[i]);
-          if (event && typeof event === "object") events.push(event);
-        } catch (e) {}
-      }
-      return events;
-    } catch (e) {
-      return null;
-    }
-  }
 
   // Auto-migrate sessions from legacy locations:
   //   v1: {cwd}/.claude-relay/sessions/
@@ -227,6 +204,11 @@ function createSessionManager(opts) {
       if (session.homeDebatePlanning) metaObj.homeDebatePlanning = true;
       if (session.homeDebatePhase) metaObj.homeDebatePhase = session.homeDebatePhase;
       if (session.homeDebateInitialTopic) metaObj.homeDebateInitialTopic = session.homeDebateInitialTopic;
+      if (session.mateScheduleDraft) metaObj.mateScheduleDraft = session.mateScheduleDraft;
+      if (session.mateSchedules) metaObj.mateSchedules = session.mateSchedules;
+      if (session.clayWorkspaceReceipts) metaObj.clayWorkspaceReceipts = session.clayWorkspaceReceipts;
+      if (session.clayMateChatReceipts) metaObj.clayMateChatReceipts = session.clayMateChatReceipts;
+      if (session.claySchedulingReceipts) metaObj.claySchedulingReceipts = session.claySchedulingReceipts;
       if (session.mateCreationMode) metaObj.mateCreationMode = true;
       if (session.homeMateCreationPhase) metaObj.homeMateCreationPhase = session.homeMateCreationPhase;
       if (session.homeClayEntryRequestId) metaObj.homeClayEntryRequestId = session.homeClayEntryRequestId;
@@ -386,6 +368,11 @@ function createSessionManager(opts) {
       if (m.homeDebatePlanning) session.homeDebatePlanning = true;
       if (m.homeDebatePhase) session.homeDebatePhase = m.homeDebatePhase;
       if (m.homeDebateInitialTopic) session.homeDebateInitialTopic = m.homeDebateInitialTopic;
+      if (m.mateScheduleDraft) session.mateScheduleDraft = m.mateScheduleDraft;
+      if (m.mateSchedules) session.mateSchedules = m.mateSchedules;
+      if (Array.isArray(m.clayWorkspaceReceipts)) session.clayWorkspaceReceipts = m.clayWorkspaceReceipts;
+      if (Array.isArray(m.clayMateChatReceipts)) session.clayMateChatReceipts = m.clayMateChatReceipts;
+      if (Array.isArray(m.claySchedulingReceipts)) session.claySchedulingReceipts = m.claySchedulingReceipts;
       if (m.mateCreationMode) session.mateCreationMode = true;
       if (m.homeMateCreationPhase) session.homeMateCreationPhase = m.homeMateCreationPhase;
       if (m.homeClayEntryRequestId) session.homeClayEntryRequestId = m.homeClayEntryRequestId;
@@ -460,9 +447,6 @@ function createSessionManager(opts) {
   //   - Warmup shape: 1 real "hi" prompt, optional automatic interruption,
   //     and 0 assistant messages (covered by daemon cleanup but defensive)
   function adoptOrphanedCliSessions() {
-    var files;
-    try { files = fs.readdirSync(cliSessionsDir); } catch (e) { return; }
-
     // Build set of cliSessionIds Clay already tracks
     var knownCliIds = new Set();
     sessions.forEach(function (s) {
@@ -471,56 +455,10 @@ function createSessionManager(opts) {
 
     var adopted = 0;
 
-    for (var i = 0; i < files.length; i++) {
-      if (!files[i].endsWith(".jsonl")) continue;
-      var cliSid = files[i].slice(0, -".jsonl".length);
-      if (knownCliIds.has(cliSid)) continue;
-      if (deletedCliSessionIds.has(cliSid)) continue;
-
-      var fp = path.join(cliSessionsDir, files[i]);
-      var events = readCliTranscriptHead(fp);
-      if (!events) continue;
-      var userCount = 0;
-      var firstUserText = null;
-      var createdAtIso = null;
-      for (var li = 0; li < events.length; li++) {
-        var ev = events[li];
-        if (ev.type === "user" && ev.message && ev.message.role === "user") {
-          userCount++;
-          if (firstUserText == null) {
-            var c = ev.message.content;
-            if (typeof c === "string") {
-              firstUserText = c;
-            } else if (Array.isArray(c)) {
-              var parts = [];
-              for (var ci = 0; ci < c.length; ci++) {
-                if (c[ci] && c[ci].type === "text" && typeof c[ci].text === "string") parts.push(c[ci].text);
-              }
-              firstUserText = parts.join("");
-            }
-            if (ev.timestamp && !createdAtIso) createdAtIso = ev.timestamp;
-          }
-        }
-      }
-
-      if (userCount === 0) continue;
-      // Defensive warmup skip (daemon also cleans these)
-      if (hygiene.isClaudeWarmupTranscript(events)) continue;
-
-      // Title: first user message trimmed/truncated. Fall back to a
-      // neutral label so the sidebar entry is identifiable.
-      var title = (firstUserText || "").trim().replace(/\s+/g, " ");
-      if (title.length > 60) title = title.slice(0, 57) + "...";
-      if (!title) title = "Imported CLI session";
-
-      var createdAt = Date.now();
-      if (createdAtIso) {
-        var t = Date.parse(createdAtIso);
-        if (!isNaN(t)) createdAt = t;
-      }
-      var lastActivity = createdAt;
-      try { lastActivity = fs.statSync(fp).mtimeMs; } catch (e) {}
-
+    var candidates = require("./yoke/legacy-sessions").candidates(cliSessionsDir, knownCliIds, deletedCliSessionIds);
+    for (var i = 0; i < candidates.length; i++) {
+      var candidate = candidates[i], cliSid = candidate.id;
+      var title = candidate.title, createdAt = candidate.createdAt, lastActivity = candidate.lastActivity;
       var localId = nextLocalId++;
       var session = {
         localId: localId,
@@ -538,7 +476,7 @@ function createSessionManager(opts) {
         history: [],
         messageUUIDs: [],
         lastRewindUuid: null,
-        vendor: "claude",
+        vendor: candidate.vendor,
         mode: "tui",
         // Adopted from an external `claude` run in this cwd, not started by
         // Clay. Notification emitters must stay silent for these until the
@@ -570,10 +508,7 @@ function createSessionManager(opts) {
     var stale = [];
     sessions.forEach(function (session) {
       if (!session.adopted || !session.cliSessionId) return;
-      var transcriptPath = path.join(cliSessionsDir, session.cliSessionId + ".jsonl");
-      var events = readCliTranscriptHead(transcriptPath);
-      var missingEmptySource = !fs.existsSync(transcriptPath) && (!session.history || session.history.length === 0);
-      if (missingEmptySource || (events && hygiene.isClaudeWarmupTranscript(events))) stale.push(session.localId);
+      if (require("./yoke/legacy-sessions").obsolete(cliSessionsDir, session)) stale.push(session.localId);
     });
     for (var i = 0; i < stale.length; i++) deleteSessionQuiet(stale[i]);
     if (stale.length > 0) {
@@ -867,7 +802,8 @@ function createSessionManager(opts) {
       if (_item && (_item.type === "mention_user" || _item.type === "mention_response")) {
         console.log("[DEBUG replayHistory] sending mention at index=" + i + " from=" + fromIndex + " total=" + total + " type=" + _item.type + " mate=" + (_item.mateName || ""));
       }
-      var replayItem = transform ? transform(_item) : _item;
+      var normalizedItem = require("./yoke/usage").clientEvent(_item, session.vendor || "claude");
+      var replayItem = transform ? transform(normalizedItem) : normalizedItem;
       if (replayItem && typeof replayItem === "object") replayItem = Object.assign({}, replayItem, { _historyIndex: i });
       _send(replayItem);
     }
@@ -877,9 +813,11 @@ function createSessionManager(opts) {
     var lastModelUsage = null;
     var lastCost = null;
     var lastStreamInputTokens = null;
+    var lastContext = null;
     for (var j = total - 1; j >= 0; j--) {
       if (session.history[j].type === "result") {
-        var r = session.history[j];
+        var r = require("./yoke/usage").clientEvent(session.history[j], session.vendor || "claude");
+        lastContext = r.context || null;
         lastUsage = r.usage || null;
         lastModelUsage = r.modelUsage || null;
         lastCost = r.cost != null ? r.cost : null;
@@ -888,7 +826,7 @@ function createSessionManager(opts) {
       }
     }
 
-    _send({ type: "history_done", lastUsage: lastUsage, lastModelUsage: lastModelUsage, lastCost: lastCost, lastStreamInputTokens: lastStreamInputTokens, contextUsage: session.lastContextUsage || null });
+    _send({ type: "history_done", lastUsage: lastUsage, lastModelUsage: lastModelUsage, lastCost: lastCost, lastStreamInputTokens: lastStreamInputTokens, context: lastContext, contextUsage: require("./yoke/usage").context(session.lastContextUsage, session.vendor || "claude") });
     for (var vi = 0; vi < sessionViewedListeners.length; vi++) {
       try { sessionViewedListeners[vi](session, targetWs, _send); } catch (e) {}
     }

package/lib/terminal-manager.js

@@ -1,4 +1,5 @@
 var { createTerminal } = require("./terminal");
+var crypto = require("crypto");
 
 var MAX_TERMINALS = 10;
 var SCROLLBACK_MAX = 50 * 1024; // 50 KB per terminal
@@ -48,6 +49,7 @@ function createTerminalManager(opts) {
     var id = nextId++;
     var session = {
       id: id,
+      identity: crypto.randomUUID(),
       pty: pty,
       scrollback: [],
       scrollbackSize: 0,
@@ -59,8 +61,11 @@ function createTerminalManager(opts) {
       lastActivityAt: Date.now(),
       exited: false,
       exitCode: null,
+      exitWaiters: [],
       subscribers: new Set(),
       ownerWs: ownerWs || null,
+      ownerId: ownerWs && ownerWs._clayUser ? ownerWs._clayUser.id : opts && opts.ownerId || null,
+      osIdentity: osUserInfo ? JSON.stringify([osUserInfo.user, osUserInfo.uid, osUserInfo.gid, osUserInfo.home]) : null,
       onExitHook: (opts && typeof opts.onExit === "function") ? opts.onExit : null,
       onDataHook: (opts && typeof opts.onData === "function") ? opts.onData : null,
     };
@@ -95,6 +100,7 @@ function createTerminalManager(opts) {
       session.exited = true;
       session.exitCode = e && e.exitCode != null ? e.exitCode : null;
       session.pty = null;
+      session.exitWaiters.splice(0).forEach(function (resolve) { resolve(true); });
 
       var msg = JSON.stringify({ type: "term_exited", id: id });
       for (var ws of session.subscribers) {
@@ -204,6 +210,34 @@ function createTerminalManager(opts) {
     if (terminals.size === 0) nextId = 1;
   }
 
+  // Keep the terminal registered until its actual exit acknowledges shutdown.
+  async function closeAndWait(id, control) {
+    var session = terminals.get(id);
+    if (!session) throw new Error("Terminal closure cannot be confirmed: runtime is missing.");
+    if (control) { control.revalidate(); if (session.identity !== control.identity) throw new Error('The exact terminal identity changed.'); }
+    if (!session.exited) {
+      if (!session.pty) throw new Error("Terminal closure is unconfirmed.");
+      var timer, waiter;
+      var exited = new Promise(function (resolve, reject) {
+        waiter = resolve; session.exitWaiters.push(waiter);
+        timer = setTimeout(function () { reject(new Error("Terminal exit acknowledgement timed out.")); }, 5000);
+      });
+      try { session.pty.kill(); await exited; }
+      catch (error) { exited.catch(function () {}); throw error; }
+      finally { clearTimeout(timer); var index = session.exitWaiters.indexOf(waiter); if (index >= 0) session.exitWaiters.splice(index, 1); }
+    }
+    if (terminals.get(id) !== session) {
+      var replaced = new Error('Terminal was replaced during shutdown.');
+      if (control) replaced.productControlResult = { runtimeEffect: session.exited ? 'exited' : 'closure_unconfirmed', replacementRetained: true, retrySafe: false };
+      throw replaced;
+    }
+    if (control) {
+      try { control.revalidate(); }
+      catch (error) { error.productControlResult = { runtimeEffect: 'exited', retained: true, retrySafe: false }; throw error; }
+    }
+    close(id); return true;
+  }
+
   function rename(id, title) {
     var session = terminals.get(id);
     if (!session) return;
@@ -298,6 +332,24 @@ function createTerminalManager(opts) {
     write: write,
     resize: resize,
     close: close,
+    closeAndWait: closeAndWait,
+    inspect: function (id) {
+      var terminal = terminals.get(id);
+      return terminal ? { id: id, identity: terminal.identity, ownerId: terminal.ownerId, osIdentity: terminal.osIdentity, title: terminal.title, kind: terminal.kind, exited: terminal.exited, cols: terminal.cols, rows: terminal.rows, totalBytesWritten: terminal.totalBytesWritten } : null;
+    },
+    resizeExact: function (id, cols, rows, identity, revalidate) {
+      revalidate();
+      var terminal = terminals.get(id);
+      if (!terminal || terminal.identity !== identity || !terminal.pty) throw new Error('The exact terminal is unavailable for resizing.');
+      terminal.pty.resize(cols, rows);
+      revalidate();
+      if (terminals.get(id) !== terminal) throw new Error('Terminal was replaced during resize.');
+      terminal.cols = cols; terminal.rows = rows;
+      var message = JSON.stringify({ type: 'term_resized', id: id, cols: cols, rows: rows });
+      terminal.subscribers.forEach(function (ws) { if (ws.readyState === 1) ws.send(message); });
+      return true;
+    },
+    identity: function (id) { var terminal = terminals.get(id); return terminal ? terminal.identity : null; },
     rename: rename,
     list: list,
     getScrollback: getScrollback,

package/lib/tool-llm.js

@@ -36,7 +36,7 @@ async function complete(opts) {
       skipProjectInstructions: true,
       skipSkills: true,
       canUseTool: function () { return Promise.resolve({ behavior: "deny", message: "Capsule LLM calls cannot use tools." }); },
-      adapterOptions: { CLAUDE: { linuxUser: opts.linuxUser || undefined, settingSources: ["user"] } },
+      adapterOptions: require("./yoke/query-options").map(adapter, { instructionSources: ["user"], readOnly: true, isolation: { user: opts.linuxUser || undefined } }),
     },
   });
   return result.text;

package/lib/tui-transcript-index.js

@@ -1,132 +1 @@
-// tui-transcript-index.js
-//
-// Build a per-session index of assistant text messages from a Claude Code
-// TUI transcript (~/.claude/projects/{encoded-cwd}/{cliSessionId}.jsonl).
-//
-// The TUI message-grab feature uses this index on the client to map a
-// hovered xterm region back to its original markdown source. We only
-// extract assistant text blocks. Tool calls and tool results render in
-// the terminal in a shape that's quite different from their JSONL form,
-// so matching them would be noisy and not particularly useful.
-//
-// Codex sessions don't write transcripts at all; callers should skip
-// indexing for non-claude vendors.
-
-var fs = require("fs");
-var path = require("path");
-var utils = require("./utils");
-var { REAL_HOME } = require("./config");
-
-var encodeCwd = utils.encodeCwd;
-
-// Min length of a normalized assistant message to bother indexing.
-// Anything shorter ("ok", "sure", "yes") would generate too many false
-// positives when matched against a hovered terminal block.
-var MIN_MATCH_LEN = 20;
-
-// Claude Code writes its JSONL under the *running user's* home, which
-// is not the daemon's home in OS-isolation mode (where each Clay user
-// gets a real Linux account like /home/clay-name). Callers from the
-// project context resolve the session owner's home and pass it in;
-// when no home is provided we fall back to REAL_HOME for single-user
-// installs.
-function transcriptFilePath(home, cwd, cliSessionId) {
-  if (!cwd || !cliSessionId) return null;
-  var base = home || REAL_HOME;
-  return path.join(base, ".claude", "projects", encodeCwd(cwd), cliSessionId + ".jsonl");
-}
-
-// matchKey is just whitespace-normalized raw markdown. We intentionally
-// do NOT strip markdown decoration here.
-//
-// Reasoning: TUI rendering drops markdown markers (**bold** -> bold,
-// `code` -> code, [text](url) -> text, etc.) and the visible text is
-// therefore always a substring of the JSONL source's character stream.
-// If we strip server-side we risk getting the rules wrong on corner
-// cases (double-backtick code spans, list-bullet rendering quirks,
-// nested formatting) and the resulting matchKey diverges from both
-// sides at once. Leaving the source alone and letting the client do a
-// multi-offset substring probe against block text is more robust and
-// much less code.
-function normalizeForMatch(s) {
-  if (!s) return "";
-  return s.replace(/\s+/g, " ").trim();
-}
-
-// Stable per-message id. Claude's JSONL usually carries one of these but
-// fall back to the parsed line index so the client always has a handle.
-function messageId(obj, index) {
-  if (obj && obj.uuid) return String(obj.uuid);
-  if (obj && obj.message && obj.message.id) return String(obj.message.id);
-  return "msg-" + index;
-}
-
-// Parse a single JSONL line into one assistant-text record, or null
-// when the line isn't one we index (user prompts, tool_use blocks,
-// tool_result records, etc.). Text-only assistant blocks get joined
-// in order so a multi-block response surfaces as a single grabbable
-// message.
-function parseAssistantTextLine(line, index) {
-  var obj;
-  try { obj = JSON.parse(line); } catch (e) { return null; }
-  if (!obj || !obj.message) return null;
-  if (obj.message.role !== "assistant") return null;
-  if (!Array.isArray(obj.message.content)) return null;
-
-  var text = "";
-  for (var i = 0; i < obj.message.content.length; i++) {
-    var block = obj.message.content[i];
-    if (block && block.type === "text" && typeof block.text === "string") {
-      text += block.text;
-    }
-  }
-  text = text.trim();
-  if (!text) return null;
-
-  var normalized = normalizeForMatch(text);
-  if (normalized.length < MIN_MATCH_LEN) return null;
-
-  return {
-    id: messageId(obj, index),
-    text: text,
-    matchKey: normalized,
-  };
-}
-
-// Read the whole transcript and return the assistant text index. The
-// transcripts are small enough (KB to a few MB) that a sync read on
-// session open or on a watcher-driven update is fine. We also return
-// the mtime/size so callers can short-circuit re-reads when nothing
-// changed.
-function readAssistantIndex(home, cwd, cliSessionId) {
-  var file = transcriptFilePath(home, cwd, cliSessionId);
-  if (!file) return { messages: [], mtimeMs: 0, byteLength: 0 };
-  var raw;
-  var stat;
-  try {
-    raw = fs.readFileSync(file, "utf8");
-    stat = fs.statSync(file);
-  } catch (e) {
-    return { messages: [], mtimeMs: 0, byteLength: 0 };
-  }
-  var lines = raw.split("\n");
-  var messages = [];
-  for (var i = 0; i < lines.length; i++) {
-    if (!lines[i]) continue;
-    var entry = parseAssistantTextLine(lines[i], i);
-    if (entry) messages.push(entry);
-  }
-  return {
-    messages: messages,
-    mtimeMs: stat.mtimeMs || 0,
-    byteLength: stat.size || raw.length,
-  };
-}
-
-module.exports = {
-  MIN_MATCH_LEN: MIN_MATCH_LEN,
-  transcriptFilePath: transcriptFilePath,
-  readAssistantIndex: readAssistantIndex,
-  parseAssistantTextLine: parseAssistantTextLine,
-  normalizeForMatch: normalizeForMatch,
-};
+module.exports = require("./yoke/tui-transcript-index");

package/lib/users-permissions.js

@@ -64,15 +64,12 @@ function attachPermissions(deps) {
   // --- Project access helpers ---
 
   function canAccessProject(userId, project) {
-    if (!project) return false;
+    if (!project || !userId || !findUserById(userId) || project.ownershipRecovery === "required") return false;
     if (project.isMate === true || (typeof project.slug === "string" && project.slug.indexOf("mate-") === 0)) {
       return !!userId && !!project.ownerId && project.ownerId === userId;
     }
     // Public projects are accessible to all authenticated users
     if (!project.visibility || project.visibility === "public") return true;
-    // Admin always has access
-    var user = findUserById(userId);
-    if (user && user.role === "admin") return true;
     // Owner always has access to their own project
     if (project.ownerId && project.ownerId === userId) return true;
     // Private project -- check allowedUsers
@@ -96,10 +93,7 @@ function attachPermissions(deps) {
       return !!userId && !!session.ownerId && session.ownerId === userId;
     }
     if (session.userKnowledgeOwnerId) return !!userId && session.userKnowledgeOwnerId === userId && session.ownerId === userId;
-    // Resolve the stored user record so client-supplied roles cannot elevate access.
-    var user = findUserById(userId);
-    if (user && user.role === "admin") return true;
-    // Sessions without ownerId are legacy -- only admin can see them
+    // Unowned historical sessions require explicit recovery; role is not ownership.
     if (!session.ownerId) return false;
     // Owner can always see their own sessions
     if (session.ownerId === userId) return true;

package/lib/users.js

@@ -155,6 +155,10 @@ function getOtherUsers(excludeUserId) {
 }
 
 function removeUser(userId) {
+  var registered = require("./config").loadConfig();
+  if (registered && (registered.projects || []).some(function (project) {
+    return !require("./project-ownership").isPersonal(project) && project.ownerId === userId;
+  })) return { error: "Transfer ordinary owned projects before deleting this account." };
   var data = loadUsers();
   var before = data.users.length;
   data.users = data.users.filter(function (u) { return u.id !== userId; });

package/lib/vendor-login-browser.js

@@ -7,17 +7,7 @@ var spawn = require("child_process").spawn;
 var buildUserEnv = require("./build-user-env").buildUserEnv;
 var wrapSpawnAsUser = require("./os-users").wrapSpawnAsUser;
 
-function loginUrl(value, vendor) {
-  try {
-    var url = new URL(value);
-    var hosts = vendor === "codex" ? ["auth.openai.com"] : ["claude.ai", "claude.com", "console.anthropic.com", "platform.claude.com"];
-    if (url.protocol !== "https:" || url.username || url.password || hosts.indexOf(url.hostname) < 0) return null;
-    if (!url.searchParams.get("state") || !url.searchParams.get("code_challenge")) return null;
-    var callback = new URL(url.searchParams.get("redirect_uri"));
-    if (callback.protocol !== "http:" || ["localhost", "127.0.0.1", "[::1]"].indexOf(callback.hostname) < 0) return null;
-    return url.href;
-  } catch (e) { return null; }
-}
+var loginUrl = require("./yoke/login-protocol").loginUrl;
 
 function createLoginBrowser(options) {
   var initial = null;

package/lib/workspace-query-access.js

@@ -96,7 +96,10 @@ function attachWorkspaceQueryAccess(deps) {
     // as ownership would let a stale status skip the authoritative record.
     var access = record(status);
     if (!access) return denied;
-    if (access.ownerId && access.ownerId === principal.userId) return { owned: true, accessible: true };
+    if (access.ownerId && access.ownerId === principal.userId) {
+      var ownerPermitted = permitted(principal.userId, access);
+      return { owned: ownerPermitted, accessible: ownerPermitted };
+    }
     return { owned: false, accessible: permitted(principal.userId, access) };
   }
 

package/lib/ws-schema.js

@@ -495,10 +495,11 @@ var schema = {
   "note_written":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Agent created or updated a sticky note" },
   "note_update":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Update a sticky note" },
   "note_updated":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was updated" },
-  "note_close":               { direction: "c2s", handler: "lib/project-user-message.js", description: "Close a sticky note (reversible; never deletes)" },
+  "note_update_result":        { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Correlated sticky note update result" },
+  "note_close":               { direction: "c2s", handler: "lib/project-user-message.js", description: "Close a sticky note; human draft-aware requests remove empty notes, tool and legacy closes stay reversible" },
   "note_reopen":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Reopen a closed sticky note" },
   "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Retired: older clients still send this; handled as a non-destructive close" },
-  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Retired: never sent. Closing broadcasts note_updated instead" },
+  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "A sticky note was permanently removed after a human-authorized storage transaction" },
   "note_list_request":        { direction: "c2s", handler: "lib/project-user-message.js", description: "Request the full notes list" },
   "note_bring_front":         { direction: "c2s", handler: "lib/project-user-message.js", description: "Bring a note to front (update z-order)" },
   "notes_list":               { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sticky notes" },
@@ -809,6 +810,11 @@ var schema = {
   "default_vendor_get":       { direction: "c2s", handler: "lib/server-default-vendor.js", description: "Read the authenticated user's New session vendor preference" },
   "default_vendor_set":       { direction: "c2s", handler: "lib/server-default-vendor.js", description: "Validate and persist the authenticated user's New session vendor preference" },
   "default_vendor_state":     { direction: "s2c", handler: "lib/public/modules/default-vendor.js", description: "Correlated or same-user-broadcast New session vendor preference" },
+  "clay_ui_ready":            { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Advertise exact owner UI navigation support on this socket" },
+  "clay_navigation_offer":    { direction: "s2c", handler: "lib/public/modules/clay-owner-navigation.js", description: "Offer one exact reviewed navigation to a selected owner connection" },
+  "clay_navigation_claim":    { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Claim an offered navigation with live source/target revalidation" },
+  "clay_navigation_apply":    { direction: "s2c", handler: "lib/public/modules/clay-owner-navigation.js", description: "Invoke the shared conversation navigator after live claim" },
+  "clay_navigation_ack":      { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Client invocation acknowledgement; never proof of visible rendering" },
   "context_view_get":         { direction: "c2s", handler: "lib/server-context-view.js", description: "Read the authenticated user's context display preference" },
   "context_view_set":         { direction: "c2s", handler: "lib/server-context-view.js", description: "Persist the authenticated user's context display preference" },
   "context_view_state":       { direction: "s2c", handler: "lib/public/modules/context-view-preference.js", description: "Correlated or same-user-broadcast context display preference" },

package/lib/yoke/acp-agent-profiles.js

@@ -9,8 +9,9 @@ var execFile = require("child_process").execFile;
 var execFileSync = require("child_process").execFileSync;
 
 function findOnPath(binaryName, overrideName) {
-  var overridePath = overrideName && process.env[overrideName];
-  if (overridePath && fs.existsSync(overridePath)) return overridePath;
+  var discovery = require("./discovery");
+  var overridePath = overrideName && discovery.explicitEntry(process.env, overrideName, false);
+  if (overridePath !== undefined && overrideName) return overridePath;
   try {
     var command = process.platform === "win32" ? "where" : "which";
     var out = execFileSync(command, [binaryName], {
@@ -18,7 +19,8 @@ function findOnPath(binaryName, overrideName) {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
     });
-    return out.trim().split(/\r?\n/)[0] || null;
+    var resolved = out.trim().split(/\r?\n/)[0] || null;
+    return discovery.validEntry(resolved, false) ? resolved : null;
   } catch (e) {
     return null;
   }

package/lib/yoke/adapters/antigravity.js

@@ -3,19 +3,7 @@ var childProcess = require("child_process");
 var readline = require("readline");
 var skillDiscovery = require("../skill-discovery");
 
-function findBinary() {
-  if (process.env.ANTIGRAVITY_CLI_PATH) return process.env.ANTIGRAVITY_CLI_PATH;
-  try {
-    var command = process.platform === "win32" ? "where" : "which";
-    return childProcess.execFileSync(command, ["agy"], {
-      encoding: "utf8",
-      timeout: 3000,
-      stdio: ["pipe", "pipe", "pipe"],
-    }).trim().split(/\r?\n/)[0] || null;
-  } catch (e) {
-    return null;
-  }
-}
+var findBinary = require("../providers/antigravity-executable").resolve;
 
 function modelValue(model) {
   if (typeof model === "string") return model;
@@ -427,7 +415,8 @@ function createAntigravityAdapter(opts) {
   var adapter = {
     vendor: "antigravity",
     init: async function(initOpts) {
-      if (!binaryPath) binaryPath = findBinary();
+      if (opts.linuxUser || initOpts && initOpts.linuxUser) throw new Error("Antigravity does not support mapped OS-user execution.");
+      if (!binaryPath) binaryPath = findBinary({ env: initOpts && initOpts.env || opts.env || process.env });
       if (!binaryPath) throw new Error("Antigravity CLI binary not found: agy");
       var fetched = opts._fetchModels ? await opts._fetchModels(binaryPath, cwd) : await fetchModels(binaryPath, cwd);
       if (fetched && fetched.length) cachedModels = fetched;

package/lib/yoke/adapters/claude-query-contract.js

@@ -0,0 +1,9 @@
+// Init-free provider transport obligations, shared by the registry and adapter.
+module.exports = {
+  questionInput: function(name, input) { return name === "AskUserQuestion" ? input : null; },
+  toolTransport: "sdk-mcp",
+  catalogLifetime: "query",
+  permissionModes: ["auto"],
+  mcpPermissionOverrides: true,
+  interruptionMessage: "Interrupted · What should Claude do instead?",
+};