clay-server 5.2.1-beta.1 → 5.3.0-beta.1

package/lib/public/style.css

@@ -9,6 +9,9 @@
 @import url("css/title-bar.css?v=20261018-workbench-controls2");
 @import url("css/clay-workspace.css?v=20261010-tint");
 @import url("css/pane.css");
+@import url("css/split-view-layout.css");
+@import url("css/pane-header-controls.css");
+@import url("css/split-view-worker-activity.css");
 @import url("css/worker-proposal.css");
 @import url("css/workspace-assignment.css");
 @import url("css/session-actions.css?v=20260828-contrast1");
@@ -76,7 +79,7 @@
 @import url("./css/mcp-skills-workbench.css");
 @import url("css/skills-workbench.css");
 
-@import url("css/right-workbench.css?v=20261018-workbench-region");
+@import url("css/right-workbench.css?v=20261020-workbench-overlay");
 
 @import url("css/mate-conversation.css");
 
@@ -94,4 +97,5 @@
 @import url("css/clay-tool-activity.css");
 
 @import url("css/contextual-clay.css?v=20261018-loading-scene");
+@import url("css/popup-chat.css");
 @import url("css/mate-loading-scene.css");

package/lib/sdk-bridge.js

@@ -1413,7 +1413,7 @@ function createSDKBridge(opts) {
     guardedPush.exactProductDelivery = !!(beforePush && beforePush.exactProductDelivery);
     session._queryGeneration = (session._queryGeneration || 0) + 1;
     session._queryStarting = true;
-    var starting = startQueryInner(session, text, images, linuxUser, guardedPush, onAccepted, recoveryState);
+    var starting = startQueryInner(session, text, images, linuxUser, guardedPush, onAccepted, recoveryState, payload);
     if (recoveryState) recoveryState.starting = starting;
     try {
       var accepted = await starting;
@@ -1494,7 +1494,7 @@ function createSDKBridge(opts) {
     };
   }
 
-  async function startQueryInner(session, text, images, linuxUser, beforePush, onAccepted, recoveryState) {
+  async function startQueryInner(session, text, images, linuxUser, beforePush, onAccepted, recoveryState, admissionPayload) {
     var sessionRuntimeEnv = getRuntimeEnv(session);
     var resumedAtQueryStart = !!session.cliSessionId;
     async function ensureVendorReady(vendor) {
@@ -1939,6 +1939,10 @@ function createSDKBridge(opts) {
         if (waiting) session._providerRecoveryWaiting = queryGeneration;
         else delete session._providerRecoveryWaiting;
       },
+      onRecoveryDiagnostic: function(evidence) {
+        if (sm.sessions.get(session.localId) !== session || Number(session._sdkQueryGeneration || 0) !== queryGeneration) return;
+        console.info('[sdk-bridge] Codex recovery admission ' + JSON.stringify({ sessionId: session.localId, queryGeneration: queryGeneration, evidence: evidence }));
+      },
       onRecoveryWaiting: function(waiting) {
         if (!queryContextAvailable()) return;
         sendAndRecord(session, { type: 'informational', level: 'info', content: waiting
@@ -2050,7 +2054,16 @@ function createSDKBridge(opts) {
       session.queryInstance = null;
       session.messageQueue = null;
       session.abortController = null;
-      sendAndRecord(session, { type: "error", text: "Failed to start query: " + (e.message || e) });
+      var startupError = { type: "error", text: "Failed to start query: " + (e.message || e) };
+      if (e.code === 'CODEX_RECOVERY_UNAVAILABLE' || e.code === 'CODEX_RECOVERY_PROBE_UNAVAILABLE') {
+        // Keep undelivered input with the persisted failure, outside the live
+        // input queue. A subsequent explicit send must not replay this batch.
+        startupError.recoveryAdmission = { state: 'not_sent', messages: [admissionPayload].concat(session.pendingPush || []).filter(Boolean).map(function(message) {
+          return { text: message.text, images: message.images || null };
+        }) };
+        startupError.text += ' Messages received during this wait were also not sent; they remain retained with this conversation. Send the messages you want to retry explicitly.';
+      }
+      sendAndRecord(session, startupError);
       sendAndRecord(session, { type: "done", code: 1 });
       sm.broadcastSessionList();
       return false;

package/lib/server-owner-ui.js

@@ -3,6 +3,7 @@ var crypto = require('crypto');
 function attachOwnerUi(ctx) {
   var identities = new WeakMap(), capabilities = new WeakMap(), deliveries = new Map();
   var activityOrder = 0;
+  var viewObservation = require('./server-owner-view-observation').attachViewObservation({ check: check, timeout: ctx.renderTimeoutMs });
   function activity(owner, slug, sessionId, mateId, selected, source, validateSource, navigationTarget) {
     var order = ++activityOrder;
     var viewers = selected ? [check(owner, selected)] : sockets(owner).filter(function (viewer) {
@@ -80,6 +81,7 @@ function attachOwnerUi(ctx) {
     return Object.assign({}, record.result);
   }
   function handleMessage(ws, msg) {
+    if (viewObservation.handleMessage(ws, msg)) return true;
     if (['clay_ui_ready', 'clay_navigation_claim', 'clay_navigation_ack', 'clay_navigation_rendered'].indexOf(msg.type) < 0) return false;
     var owner = ctx.isMultiUser() ? ws._clayUser && ws._clayUser.id : null;
     if (!sockets(owner).some(function (item) { return item.ws === ws; })) return true;
@@ -95,7 +97,9 @@ function attachOwnerUi(ctx) {
         if (!record.renderClosed && Date.now() > record.created + (ctx.renderTimeoutMs || 5000)) { record.renderClosed = true; clearTimeout(record.renderTimer); record.result.renderStatus = 'unknown'; if (record.activity) record.activity.navigation('unknown'); }
         if (record.renderClosed || !record.claimed || !record.result.acknowledged || record.result.clientStatus !== 'accepted' || msg.renderToken !== record.renderToken) return true;
         var current = inspect(owner, record.viewer.ref);
-        if (current.ws !== ws || msg.sessionOriginId !== record.target.sessionOriginId || !record.target.sessionOriginId || msg.projectSlug !== record.target.projectSlug || msg.sessionId !== record.target.sessionId || msg.surface !== 'conversation' || msg.entryIndex !== record.target.entryIndex || current.slug !== record.target.projectSlug || current.sessionId !== record.target.sessionId) throw new Error('Rendered target or authenticated viewer changed.');
+        if (record.target.surface === 'split_view') {
+          require('./clay-split-view-render-proof').validate(record.target, msg, current, ws);
+        } else if (current.ws !== ws || msg.sessionOriginId !== record.target.sessionOriginId || !record.target.sessionOriginId || msg.projectSlug !== record.target.projectSlug || msg.sessionId !== record.target.sessionId || msg.surface !== 'conversation' || msg.entryIndex !== record.target.entryIndex || current.slug !== record.target.projectSlug || current.sessionId !== record.target.sessionId) throw new Error('Rendered target or authenticated viewer changed.');
         record.renderClosed = true; clearTimeout(record.renderTimer);
         record.result.renderStatus = msg.visible === true ? 'rendered' : 'unknown'; record.result.visible = msg.visible === true ? true : 'unknown';
         if (record.activity) record.activity.navigation(msg.visible === true ? 'rendered' : 'unknown');
@@ -113,6 +117,6 @@ function attachOwnerUi(ctx) {
     } catch (error) { record.renderClosed = true; clearTimeout(record.renderTimer); record.result.visible = 'unknown'; record.result.status = 'failed'; record.result.error = error.message; record.result.retrySafe = false; if (record.activity) record.activity.cancel(); }
     return true;
   }
-  return { list: sockets, inspect: inspect, check: check, deliver: deliver, read: read, handleMessage: handleMessage, activity: activity };
+  return { observeView: viewObservation.observe, list: sockets, inspect: inspect, check: check, deliver: deliver, read: read, handleMessage: handleMessage, activity: activity };
 }
 module.exports = { attachOwnerUi: attachOwnerUi };

package/lib/server-owner-view-observation.js

@@ -0,0 +1,34 @@
+var crypto = require('crypto');
+// A short-lived challenge addresses one authenticated socket. It never navigates.
+function attachViewObservation(ctx) {
+  var pending = new Map();
+  function observe(owner, viewer, revalidate) {
+    revalidate(); ctx.check(owner, viewer);
+    if (!viewer.supported) return Promise.resolve({ status: 'unsupported', visible: 'unknown' });
+    if (pending.size >= 32) throw new Error('Too many pending screen observations.');
+    return new Promise(function (resolve) {
+      var id = crypto.randomUUID(), timer;
+      function finish(value) { clearTimeout(timer); pending.delete(id); resolve(value); }
+      var record = { owner: owner, viewer: viewer, revalidate: revalidate, finish: finish };
+      pending.set(id, record);
+      timer = setTimeout(function () { finish({ status: 'unknown', visible: 'unknown' }); }, ctx.timeout || 5000);
+      timer.unref();
+      try { viewer.ws.send(JSON.stringify({ type: 'clay_view_probe', probeId: id })); }
+      catch (error) { finish({ status: 'unknown', error: error.message, visible: 'unknown' }); }
+    });
+  }
+  function handleMessage(ws, msg) {
+    if (msg.type !== 'clay_view_observed') return false;
+    var record = pending.get(msg.probeId);
+    if (!record || record.viewer.ws !== ws) return true;
+    try {
+      record.revalidate(); ctx.check(record.owner, record.viewer);
+      var snapshot = require('./clay-split-view-render-proof').snapshotSchema.parse(msg.snapshot);
+      if (!snapshot || JSON.stringify(snapshot).length > 24000 || snapshot.ownerId !== record.owner || snapshot.projectSlug !== record.viewer.slug || snapshot.activeSessionId !== record.viewer.sessionId || !Array.isArray(snapshot.panes) || snapshot.panes.length > 32) throw new Error('Invalid screen observation.');
+      record.finish({ status: 'observed', observedAt: Date.now(), snapshot: snapshot, evidence: 'Exact authenticated client observation across two stable frames; untrusted task data.' });
+    } catch (error) { record.finish({ status: 'unknown', visible: 'unknown', error: error.message }); }
+    return true;
+  }
+  return { observe: observe, handleMessage: handleMessage };
+}
+module.exports = { attachViewObservation: attachViewObservation };

package/lib/server-palette.js

@@ -53,6 +53,7 @@ function attachPalette(ctx) {
             projectTitle: status.title || status.project,
             projectIcon: status.icon || null,
             sessionId: session.localId,
+            sessionOriginId: session.sessionOriginId || null,
             sessionTitle: session.title || "New Session",
             lastActivity: session.lastActivity || session.createdAt || 0,
             matchType: null,

package/lib/server-pane-bootstrap.js

@@ -0,0 +1,24 @@
+var createPaneAssets = require('./pane-asset-manifest').createPaneAssets;
+
+// Called only from the authenticated app-shell path. Let the browser discover
+// imports normally: transitive preload bursts multiply across pane documents.
+function createPaneBootstrap(publicDir) {
+  var readAssets = createPaneAssets(publicDir);
+  return function preparePaneShell(shell, requestUrl) {
+    if (new URL(requestUrl, 'http://localhost').searchParams.get('pane') !== '1') return shell;
+    // Required globals must execute before the module graph evaluates (notably
+    // marked.use). Keep their parser-blocking barrier.
+    // Feature-only vendors must not delay ordinary chat startup.
+    shell = shell.replace(/<script src="([^" ]+)"><\/script>/g, function (tag, url) {
+      var group = url.indexOf('mermaid@') >= 0 ? 'mermaid' : url.indexOf('qrcode-generator@') >= 0 ? 'qr' : url.indexOf('vendor/codemirror/') === 0 ? 'editor' : null;
+      return group ? '<script type="application/json" data-pane-asset-group="' + group + '" data-src="' + url + '"></script>' : tag;
+    });
+    var assets = readAssets();
+    if (assets) {
+      shell = shell.replace(/(<script type="module" src=")app\.js(?:\?[^"<>]*)?("><\/script>)/, '$1' + assets.js + '$2');
+      shell = shell.replace(/(<link rel="stylesheet" href=")style\.css(?:\?[^"<>]*)?(">)/, '$1' + assets.css + '$2');
+    }
+    return shell;
+  };
+}
+module.exports = { createPaneBootstrap: createPaneBootstrap };

package/lib/server-settings.js

@@ -13,12 +13,14 @@ function attachSettings(ctx) {
 
   var profilePath = path.join(CONFIG_DIR, "profile.json");
   var contextualClaySettings = require('./server-contextual-clay-settings').attachContextualClaySettings(ctx);
+  var workbenchLayoutSettings = require('./server-workbench-layout-settings').attachWorkbenchLayoutSettings(ctx);
   var appearanceSettings = require('./server-appearance-settings').attachAppearanceSettings(ctx);
   var notificationSettings = require('./server-notification-settings').attachNotificationSettings(ctx);
   var experimentalSettings = attachExperimentalSettings(ctx);
 
   function handleRequest(req, res, fullUrl) {
     if (contextualClaySettings.handleRequest(req, res, fullUrl)) return true;
+    if (workbenchLayoutSettings.handleRequest(req, res, fullUrl)) return true;
     if (appearanceSettings.handleRequest(req, res, fullUrl)) return true;
     if (notificationSettings.handleRequest(req, res, fullUrl)) return true;
     if (experimentalSettings.handleRequest(req, res, fullUrl)) return true;

package/lib/server-static-assets.js

@@ -0,0 +1,52 @@
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+
+var MIME_TYPES = {
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".bmp": "image/bmp",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+};
+
+// This helper runs only after the caller's existing routing and authorization.
+// Re-read and hash the actual bytes: timestamps/length cannot detect every edit.
+function matches(header, etag) {
+  if (typeof header !== 'string') return false;
+  if (header.trim() === '*') return true;
+  var tag = '(?:W/)?"[\x21\x23-\x7e\x80-\xff]*"';
+  if (!new RegExp('^[ \t]*' + tag + '(?:[ \t]*,[ \t]*' + tag + ')*[ \t]*$').test(header)) return false;
+  return (header.match(new RegExp(tag, 'g')) || []).some(function (value) { return value.replace(/^W\//, '') === etag; });
+}
+function createStaticAssets(publicDir) {
+  return function serveStatic(urlPath, req, res) {
+    if (urlPath === '/') urlPath = '/index.html';
+    var filePath = path.join(publicDir, urlPath);
+    if (!filePath.startsWith(publicDir + path.sep)) {
+      res.writeHead(403); res.end('Forbidden'); return true;
+    }
+    var content;
+    try { content = fs.readFileSync(filePath); } catch (error) { return false; }
+    var ext = path.extname(filePath);
+    var mime = MIME_TYPES[ext] || 'application/octet-stream';
+    var isImage = ['.png', '.jpg', '.jpeg', '.gif', '.svg', '.webp', '.ico'].indexOf(ext) >= 0;
+    var headers = { 'Content-Type': mime + (isImage ? '' : '; charset=utf-8'),
+      'Cache-Control': isImage ? 'public, max-age=86400, immutable' : 'no-cache' };
+    if ((ext === '.js' || ext === '.css') && (req.method === 'GET' || req.method === 'HEAD')) {
+      headers.ETag = '"' + crypto.createHash('sha256').update(content).digest('hex') + '"';
+      if (matches(req.headers['if-none-match'], headers.ETag)) {
+        res.writeHead(304, headers); res.end(); return true;
+      }
+    }
+    res.writeHead(200, headers); res.end(content); return true;
+  };
+}
+module.exports = { createStaticAssets: createStaticAssets };

package/lib/server-workbench-layout-settings.js

@@ -0,0 +1,56 @@
+// User Settings deliberately have no canonical Clay control endpoint.
+function attachWorkbenchLayoutSettings(ctx) {
+  function reply(res, status, data) {
+    res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(data));
+  }
+  function identity(req) {
+    if (!ctx.isRequestAuthed(req)) return null;
+    var user = ctx.users.isMultiUser() ? ctx.getMultiUserFromReq(req) : { id: 'default' };
+    return user && (!ctx.users.isMultiUser() || ctx.users.findUserById(user.id)) ? user.id : null;
+  }
+  function handleRequest(req, res, url) {
+    if (url !== '/api/user/workbench-layout') return false;
+    var accountId = identity(req);
+    if (!accountId) { reply(res, 401, { error: 'Sign in to manage workbench layout.' }); return true; }
+    if (req.headers['x-clay-account-id'] !== accountId) { reply(res, 403, { error: 'Account changed. Reload and try again.' }); return true; }
+    if (req.method === 'GET') {
+      try { reply(res, 200, ctx.users.getWorkbenchLayoutPreference(accountId)); }
+      catch (error) { reply(res, 500, { error: 'Workbench layout could not be loaded. Try again.' }); }
+      return true;
+    }
+    if (req.method !== 'PUT') { reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    if (req.headers['x-clay-settings'] !== '1' || req.headers['sec-fetch-site'] && ['same-origin', 'none'].indexOf(req.headers['sec-fetch-site']) < 0) {
+      reply(res, 403, { error: 'Save preferences from Clay.' }); return true;
+    }
+    if (req.headers.origin) {
+      try { if (new URL(req.headers.origin).host !== req.headers.host) throw new Error('Foreign origin'); }
+      catch (error) { reply(res, 403, { error: 'Save preferences from Clay.' }); return true; }
+    }
+    var body = '', finished = false;
+    req.setEncoding('utf8');
+    req.on('data', function (chunk) {
+      if (finished) return;
+      body += chunk;
+      if (Buffer.byteLength(body) > 1024) { finished = true; body = ''; reply(res, 413, { error: 'Request too large.' }); }
+    });
+    req.on('aborted', function () { finished = true; });
+    req.on('error', function () { finished = true; });
+    req.on('end', function () {
+      if (finished) return; finished = true;
+      if (identity(req) !== accountId) { reply(res, 401, { error: 'Account changed. Sign in again.' }); return; }
+      var input;
+      try { input = JSON.parse(body); } catch (error) { reply(res, 400, { error: 'Invalid JSON.' }); return; }
+      if (!input || Array.isArray(input) || Object.keys(input).length !== 2 || !Object.prototype.hasOwnProperty.call(input, 'mode') || !Object.prototype.hasOwnProperty.call(input, 'revision')) {
+        reply(res, 400, { error: 'Invalid workbench preference.' }); return;
+      }
+      try {
+        var result = ctx.users.setWorkbenchLayoutPreference(accountId, input.mode, input.revision);
+        reply(res, result.error ? result.status || 400 : 200, result);
+      } catch (error) { reply(res, 500, { error: 'Workbench layout could not be saved. Your previous layout is retained.' }); }
+    });
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachWorkbenchLayoutSettings: attachWorkbenchLayoutSettings };

package/lib/server.js

@@ -70,20 +70,8 @@ function httpGetBinary(url) {
 }
 
 
-var MIME_TYPES = {
-  ".html": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".bmp": "image/bmp",
-  ".svg": "image/svg+xml",
-  ".ico": "image/x-icon",
-};
+var serveStatic = require('./server-static-assets').createStaticAssets(publicDir);
+var preparePaneShell = require('./server-pane-bootstrap').createPaneBootstrap(publicDir);
 
 var wsRateLimit = require("./ws-rate-limit");
 var applyWsRateLimit = wsRateLimit.applyWsRateLimit;
@@ -91,34 +79,6 @@ var WS_RATE_LIMIT = wsRateLimit.WS_RATE_LIMIT;
 var generateAuthToken = serverAuth.generateAuthToken;
 var verifyPin = serverAuth.verifyPin;
 
-function serveStatic(urlPath, res) {
-  if (urlPath === "/") urlPath = "/index.html";
-
-  var filePath = path.join(publicDir, urlPath);
-
-  if (!filePath.startsWith(publicDir)) {
-    res.writeHead(403);
-    res.end("Forbidden");
-    return true;
-  }
-
-  try {
-    var content = fs.readFileSync(filePath);
-    var ext = path.extname(filePath);
-    var mime = MIME_TYPES[ext] || "application/octet-stream";
-    var isImage = ext === ".png" || ext === ".jpg" || ext === ".jpeg" || ext === ".gif" || ext === ".svg" || ext === ".webp" || ext === ".ico";
-    var cacheControl = isImage ? "public, max-age=86400, immutable" : "no-cache";
-    res.writeHead(200, {
-      "Content-Type": mime + (isImage ? "" : "; charset=utf-8"),
-      "Cache-Control": cacheControl,
-    });
-    res.end(content);
-    return true;
-  } catch (e) {
-    return false;
-  }
-}
-
 /**
  * Extract slug from URL path: /p/{slug}/... → slug
  * Returns null if path doesn't match /p/{slug}
@@ -565,6 +525,7 @@ function createServer(opts) {
     try {
       var shell = fs.readFileSync(path.join(publicDir, "index.html"), "utf8");
       if (slug) shell = injectRootProjectSlug(shell, slug);
+      shell = preparePaneShell(shell, req.url);
       var appearance = null;
       try { appearance = settings.getInitialAppearance(req); } catch (e) {}
       shell = injectAppearanceSeed(shell, appearance);
@@ -1076,7 +1037,7 @@ function createServer(opts) {
         sendAppShell(req, res, null);
         return;
       }
-      if (serveStatic(fullUrl, res)) return;
+      if (serveStatic(fullUrl, req, res)) return;
     }
 
     // Project-scoped routes: /p/{slug}/...
@@ -1175,7 +1136,7 @@ function createServer(opts) {
         sendAppShell(req, res, slug);
         return;
       }
-      if (serveStatic(projectUrl, res)) return;
+      if (serveStatic(projectUrl, req, res)) return;
     }
 
     res.writeHead(404);
@@ -1230,7 +1191,7 @@ function createServer(opts) {
 
       // Static files at root (favicon, manifest, icons, etc.)
       if (url.lastIndexOf("/") === 0 && !url.includes("..")) {
-        if (serveStatic(url, res)) return;
+        if (serveStatic(url, req, res)) return;
       }
 
       // Everything else → redirect to HTTPS setup

package/lib/session-activity-state.js

@@ -0,0 +1,28 @@
+function count(value) { return value && typeof value === 'object' ? Object.keys(value).length : 0; }
+function sessionActivity(session) {
+  if (session.isProcessing) return 'processing';
+  if (count(session.pendingPermissions)) return 'waiting_for_approval';
+  return 'idle';
+}
+function currentState(session) {
+  var approvals = count(session.pendingPermissions);
+  var input = count(session.pendingAskUser) + count(session.pendingUserDialogs) + count(session.pendingElicitations);
+  var processing = session.isProcessing === true, starting = session._queryStarting === true;
+  var recoveryStopPending = !!session._responseRecoveryStopPending;
+  var questions = count(session.pendingAskUser), dialogs = count(session.pendingUserDialogs), elicitations = count(session.pendingElicitations);
+  var stopRequested = session.taskStopRequested === true, queuePaused = session._pendingMessageDrainPaused === true;
+  // Review requests are a subset of pending questions, never an approval result.
+  var reviews = Object.values(session.pendingAskUser || {}).filter(function (pending) { return pending && pending.request && ['product-control', 'mcp-import', 'mate-schedule'].indexOf(pending.request.source) >= 0; }).length;
+  var state = 'unknown';
+  if (stopRequested || queuePaused) state = processing || starting || recoveryStopPending ? 'stopping' : 'stopped';
+  else if (approvals || reviews) state = 'awaiting_approval';
+  else if (input) state = 'awaiting_input';
+  else if (recoveryStopPending) state = 'recovering';
+  else if (processing || starting) state = 'working';
+  else if (session.isProcessing === false) state = 'idle';
+  return { state: state, observedAt: Date.now(), recoveryStopPending: recoveryStopPending, queryGeneration: Number.isInteger(session._sdkQueryGeneration) ? session._sdkQueryGeneration : null,
+    pendingReviewCount: reviews, pendingQuestionCount: questions, pendingDialogCount: dialogs, pendingElicitationCount: elicitations, processing: processing, starting: starting, stopRequested: stopRequested, queuePaused: queuePaused,
+    pendingApprovalCount: approvals, pendingInputCount: input, providerConnection: 'unknown',
+    evidence: 'Live server session flags and pending request registries; idle does not establish task completion.' };
+}
+module.exports = { sessionActivity: sessionActivity, currentState: currentState };

package/lib/session-list-delivery.js

@@ -0,0 +1,17 @@
+// Cache only an already authorized, serialized projection for this live socket.
+// Callers must recompute visibility before every delivery; this is not an access
+// cache. Ordinary refreshes always send, even when their content is unchanged.
+function createSessionListDelivery() {
+  var delivered = new WeakMap();
+  var MAX_CACHED_BYTES = 1024 * 1024;
+  return function (ws, message, skipUnchanged) {
+    if (!ws || ws.readyState !== 1) { if (ws) delivered.delete(ws); return false; }
+    var encoded = JSON.stringify(message);
+    if (skipUnchanged && delivered.get(ws) === encoded) return false;
+    ws.send(encoded);
+    if (Buffer.byteLength(encoded) <= MAX_CACHED_BYTES) delivered.set(ws, encoded);
+    else delivered.delete(ws);
+    return true;
+  };
+}
+module.exports = { createSessionListDelivery: createSessionListDelivery };

package/lib/session-pair-turn-control.js

@@ -3,10 +3,9 @@
 // A human Stop is a cancellation barrier, not merely an AbortController
 // signal. It blocks delegation and Worker replacement until the next ordinary
 // human message reaches the Driver. Internal result and permission messages do
-// not clear it. Creation budgets and operation ids also make retries bounded
+// not clear it. Replacement budgets and operation ids also make retries bounded
 // and idempotent even when no Stop occurred.
 
-var MAX_CREATIONS_PER_TURN = 2;
 var MAX_REPLACEMENTS_PER_TURN = 1;
 var MAX_FAILED_REPLACEMENT_ATTEMPTS_PER_TURN = 2;
 var MAX_OPERATION_ID_CHARS = 120;
@@ -101,9 +100,6 @@ function attachPairTurnControl(ctx) {
     if (kind === "replace" && state.failedReplacementAttempts >= MAX_FAILED_REPLACEMENT_ATTEMPTS_PER_TURN) {
       throw new Error("the Split Worker replacement failure limit for this human turn has been reached; wait for a new human message before retrying replacement");
     }
-    if (state.creations >= MAX_CREATIONS_PER_TURN) {
-      throw new Error("the Split Worker creation limit for this human turn has been reached; wait for a new human message before creating another Worker");
-    }
     state.creations += 1;
     if (kind === "replace") state.replacements += 1;
     return { driver: driver, kind: kind, turnSerial: state.serial, active: true };
@@ -172,7 +168,6 @@ function attachPairTurnControl(ctx) {
 }
 
 module.exports = {
-  MAX_CREATIONS_PER_TURN: MAX_CREATIONS_PER_TURN,
   MAX_REPLACEMENTS_PER_TURN: MAX_REPLACEMENTS_PER_TURN,
   MAX_FAILED_REPLACEMENT_ATTEMPTS_PER_TURN: MAX_FAILED_REPLACEMENT_ATTEMPTS_PER_TURN,
   attachPairTurnControl: attachPairTurnControl,

package/lib/session-search.js

@@ -539,6 +539,7 @@ function searchPalette(projectSessions, query, opts) {
           projectTitle: proj.projectTitle,
           projectIcon: proj.projectIcon || null,
           sessionId: session.localId,
+          sessionOriginId: session.sessionOriginId || null,
           sessionTitle: title,
           lastActivity: session.lastActivity || session.createdAt || 0,
           isMate: proj.isMate || false,
@@ -561,6 +562,7 @@ function searchPalette(projectSessions, query, opts) {
             projectTitle: proj.projectTitle,
             projectIcon: proj.projectIcon || null,
             sessionId: session.localId,
+            sessionOriginId: session.sessionOriginId || null,
             sessionTitle: title,
             lastActivity: session.lastActivity || session.createdAt || 0,
             isMate: proj.isMate || false,
@@ -592,6 +594,7 @@ function searchPalette(projectSessions, query, opts) {
         projectTitle: m.projectTitle,
         projectIcon: m.projectIcon,
         sessionId: m.sessionId,
+        sessionOriginId: m.sessionOriginId,
         sessionTitle: m.sessionTitle,
         lastActivity: m.lastActivity,
         matchType: m.matchType,

package/lib/session-split-group-anchors.js

@@ -46,7 +46,7 @@ function versionedMemberAnchors(group, sessions) {
 
 function resolveVersionedPair(sessions, anchors) {
   if (!anchors || anchors.version !== 2 || !anchors.driver || !Array.isArray(anchors.workers) ||
-      (anchors.workers.length !== 1 && anchors.workers.length !== 2)) return null;
+      anchors.workers.length < 1) return null;
   var driver = findSession(sessions, anchors.driver.cli, anchors.driver.origin);
   if (!driver) return null;
   var workers = [];
@@ -62,7 +62,7 @@ function resolveVersionedPair(sessions, anchors) {
 
 function resolveVersionedMembers(sessions, anchors) {
   if (!anchors || anchors.version !== 2 || !Array.isArray(anchors.members) ||
-      (anchors.members.length !== 2 && anchors.members.length !== 3)) return null;
+      anchors.members.length < 2) return null;
   var resolved = [];
   for (var i = 0; i < anchors.members.length; i++) {
     var anchor = anchors.members[i];

package/lib/session-split-group-roles.js

@@ -1,7 +1,7 @@
 // Shared role and target identity rules for Split Groups.
 //
 // Version 1 is the persisted two-session pair shape. Version 2 describes one
-// Driver and up to two Workers, but callers must explicitly opt into it until
+// Driver and one or more Workers, but callers must explicitly opt into it until
 // all production consumers can address more than one Worker.
 // Remaining direct pair.workerId reads are deliberate compatibility branches:
 // session-split-groups owns legacy-only create and Driver-transfer transactions,
@@ -9,8 +9,6 @@
 // Production activation must still migrate the client hierarchy, pane lock, and
 // split-group helper projections before the server gate is enabled.
 
-var MAX_WORKERS = 2;
-
 function isInteger(value) {
   return Number.isInteger(value);
 }
@@ -22,8 +20,8 @@ function containsOnce(values, value) {
 }
 
 function validateMembers(members) {
-  if (!Array.isArray(members) || (members.length !== 2 && members.length !== 3)) {
-    return { ok: false, error: "A split group requires exactly two sessions until multi-Worker consumers are enabled" };
+  if (!Array.isArray(members) || members.length < 2) {
+    return { ok: false, error: "A split group requires at least two sessions" };
   }
   for (var i = 0; i < members.length; i++) {
     if (!isInteger(members[i])) return { ok: false, error: "Split group members must be distinct integer session ids" };
@@ -34,8 +32,8 @@ function validateMembers(members) {
 
 function validateRoleIds(driverId, workerIds, members) {
   if (!isInteger(driverId)) return { ok: false, error: "The Driver role must reference an integer session id" };
-  if (!Array.isArray(workerIds) || workerIds.length < 1 || workerIds.length > MAX_WORKERS) {
-    return { ok: false, error: "A configured role requires one to two Workers" };
+  if (!Array.isArray(workerIds) || workerIds.length < 1) {
+    return { ok: false, error: "A configured role requires at least one Worker" };
   }
   if (!containsOnce(members, driverId)) return { ok: false, error: "The Driver role must reference exactly one split group member" };
   var seen = [driverId];
@@ -150,7 +148,6 @@ function tokenMatchesWorker(worker, token) {
 }
 
 module.exports = {
-  MAX_WORKERS: MAX_WORKERS,
   normalizePair: normalizePair,
   matchesLiveTarget: matchesLiveTarget,
   resolveLiveRoles: resolveLiveRoles,

package/lib/session-split-group-v2-store.js

@@ -102,9 +102,6 @@ function attachVersionedMutations(ctx) {
     if (denied) return denied;
     var exact = exactGroup(ownerId, msg || {}, false);
     if (exact.error) return { ok: false, error: exact.error };
-    if (exact.normalized.workerIds.length >= splitRoles.MAX_WORKERS) {
-      return { ok: false, error: "A Driver can have at most two Workers" };
-    }
     var added = newWorker(ownerId, msg);
     if (added.error) return { ok: false, error: added.error };
     var workerIds = exact.normalized.workerIds.concat([added.worker.localId]);

package/lib/sessions.js

@@ -35,6 +35,7 @@ function createSessionManager(opts) {
   var slashCommands = null;     // shared across sessions (deprecated, use slashCommandsByVendor)
   var slashCommandsByVendor = {}; // vendor -> array of slash commands
   var skillNames = null;        // Claude-only skills to filter from slash menu
+  var deliverSessionList = require('./session-list-delivery').createSessionListDelivery();
   var singleUserUnread = {};    // sessionLocalId -> unread count (single-user mode)
   var permissionRequestIndex = {}; // requestId -> sessionLocalId (O(1) lookup)
   var capabilitiesByVendor = null; // set by sdk-bridge after adapter init
@@ -652,7 +653,7 @@ function createSessionManager(opts) {
     });
   }
 
-  function broadcastSessionList() {
+  function broadcastSessionList(skipUnchanged) {
     var allVisible = getVisibleSessions();
     if (sendEach) {
       // Per-client filtering (multi-user mode)
@@ -661,10 +662,10 @@ function createSessionManager(opts) {
         var clientActiveId = ws._clayActiveSession;
         var wsUnread = ws._clayUnread || {};
         if (ws.readyState === 1) {
-          ws.send(JSON.stringify({
+          deliverSessionList(ws, {
             type: "session_list",
             sessions: mapSessionsForClient(filtered, clientActiveId, wsUnread, ws._clayUser ? ws._clayUser.id : null),
-          }));
+          }, skipUnchanged === true);
         }
       });
     } else {
@@ -879,7 +880,7 @@ function createSessionManager(opts) {
       || session.slashCommands
       || [];
     _send({ type: "slash_commands", commands: _vendorCmds, vendor: _sessionVendor });
-    broadcastSessionList();
+    broadcastSessionList(!!(snapshotSend && targetWs && targetWs._clayPane));
     replayHistory(session, undefined, targetWs, transform, snapshotSend);
 
     if (session.isProcessing) {
@@ -973,9 +974,18 @@ function createSessionManager(opts) {
     }
   }
 
-  function deleteSessionQuiet(localId) {
+  function deleteSessionQuiet(localId, options) {
     var session = sessions.get(localId);
     if (!session) return;
+    // Exact reviewed removal must observe durable deletion before releasing identity.
+    var strictRemoval = options && options.requireDurableRemoval === true;
+    if (strictRemoval) {
+      var strictRecordId = existingSessionRecordId(session);
+      if (strictRecordId) {
+        try { fs.unlinkSync(sessionFilePath(strictRecordId)); }
+        catch (error) { if (error.code !== "ENOENT") throw error; }
+      }
+    }
     delete singleUserUnread[localId];
     cleanupMentionSessions(session);
     if (session.abortController) {
@@ -995,7 +1005,7 @@ function createSessionManager(opts) {
     }
     if (session.cliSessionId) rememberDeletedCliSession(session.cliSessionId);
     var recordId = existingSessionRecordId(session);
-    if (recordId) try { fs.unlinkSync(sessionFilePath(recordId)); } catch(e) {}
+    if (recordId && !strictRemoval) try { fs.unlinkSync(sessionFilePath(recordId)); } catch(e) {}
     sessions.delete(localId);
     try { onSessionDeleted(localId, session); } catch (e) {
       console.error("[session] Session deletion hook failed:", e.message || e);