clay-server 5.2.1-beta.1 → 5.3.0-beta.1

package/lib/split-view-layout.js

@@ -0,0 +1,132 @@
+var MAX_SESSIONS = 8;
+var MIN_RATIO = 0.05;
+var MAX_RATIO = 0.95;
+var PRESETS = ["balanced", "columns", "rows", "grid", "main-left", "main-right"];
+
+function validOrigin(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 128 && /^[A-Za-z0-9_-]+$/.test(value);
+}
+
+function validateTree(tree, expectedOrigins) {
+  var origins = [];
+  var invalid = null;
+  function walk(node, depth) {
+    if (invalid) return;
+    if (!node || typeof node !== "object" || depth > MAX_SESSIONS) { invalid = "Layout tree is malformed"; return; }
+    if (Object.prototype.hasOwnProperty.call(node, "id")) {
+      if (Object.keys(node).length !== 1 || !validOrigin(node.id) || origins.indexOf(node.id) !== -1) {
+        invalid = "Layout leaves must have unique valid session origins"; return;
+      }
+      origins.push(node.id);
+      if (origins.length > MAX_SESSIONS) invalid = "A Split view can contain at most eight sessions";
+      return;
+    }
+    if (Object.keys(node).sort().join(",") !== "axis,left,ratio,right" ||
+        ["horizontal", "vertical"].indexOf(node.axis) === -1 || typeof node.ratio !== "number" ||
+        !Number.isFinite(node.ratio) || node.ratio < MIN_RATIO || node.ratio > MAX_RATIO) {
+      invalid = "Layout branch must have a valid axis and bounded ratio"; return;
+    }
+    walk(node.left, depth + 1); walk(node.right, depth + 1);
+  }
+  walk(tree, 0);
+  if (invalid) return { ok: false, error: invalid, origins: origins };
+  if (origins.length < 2 || origins.length > MAX_SESSIONS) return { ok: false, error: "A Split view requires two to eight sessions", origins: origins };
+  if (expectedOrigins) {
+    if (!Array.isArray(expectedOrigins) || expectedOrigins.length !== origins.length ||
+        expectedOrigins.some(function (id) { return !validOrigin(id) || origins.indexOf(id) === -1; })) {
+      return { ok: false, error: "Layout leaves must exactly match the selected sessions", origins: origins };
+    }
+  }
+  return { ok: true, origins: origins };
+}
+
+function validateName(name) {
+  if (typeof name !== "string") return { ok: false, error: "Split view name is required" };
+  var normalized = name.trim();
+  if (!normalized || normalized.length > 80) return { ok: false, error: "Split view name must be between 1 and 80 characters" };
+  return { ok: true, name: normalized };
+}
+
+function validatePreset(name) {
+  return PRESETS.indexOf(name) !== -1;
+}
+
+function removeLeaf(tree, originId) {
+  if (!tree || typeof tree !== "object") return tree;
+  if (Object.prototype.hasOwnProperty.call(tree, "id")) return tree.id === originId ? null : tree;
+  var left = removeLeaf(tree.left, originId), right = removeLeaf(tree.right, originId);
+  if (!left) return right;
+  if (!right) return left;
+  if (left === tree.left && right === tree.right) return tree;
+  return { axis: tree.axis, ratio: tree.ratio, left: left, right: right };
+}
+
+function leaf(id) { return { id: id }; }
+function chain(ids, axis) {
+  if (ids.length === 1) return leaf(ids[0]);
+  return { axis: axis, ratio: 1 / ids.length, left: leaf(ids[0]), right: chain(ids.slice(1), axis) };
+}
+function grid(ids) {
+  if (ids.length <= 2) return chain(ids, "horizontal");
+  var split = Math.ceil(ids.length / 2);
+  return { axis: "vertical", ratio: split / ids.length,
+    left: chain(ids.slice(0, split), "horizontal"), right: chain(ids.slice(split), "horizontal") };
+}
+function createPreset(origins, name) {
+  if (!Array.isArray(origins) || origins.length > MAX_SESSIONS ||
+      origins.some(function (id) { return !validOrigin(id); }) || new Set(origins).size !== origins.length) {
+    throw new TypeError("Preset input must contain zero to eight unique session origins");
+  }
+  if (!validatePreset(name)) throw new TypeError("Unknown Split view preset");
+  if (!origins.length) return null;
+  if (origins.length === 1) return leaf(origins[0]);
+  if (name === "columns") return chain(origins, "horizontal");
+  if (name === "rows") return chain(origins, "vertical");
+  if (name === "grid") return grid(origins);
+  if (name === "main-left" || name === "main-right") {
+    var main = leaf(origins[0]), rest = grid(origins.slice(1)), mainShare = origins.length === 2 ? 0.5 : 2 / 3;
+    return name === "main-left" ? { axis: "horizontal", ratio: mainShare, left: main, right: rest } : { axis: "horizontal", ratio: 1 - mainShare, left: rest, right: main };
+  }
+  if (origins.length <= 3) {
+    return { axis: "horizontal", ratio: 0.55, left: leaf(origins[0]), right: chain(origins.slice(1), "vertical") };
+  }
+  return grid(origins);
+}
+
+function validateViewShape(view) {
+  if (!view || typeof view !== "object" || typeof view.id !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(view.id)) return { ok: false, error: "Split view identity is invalid" };
+  if (view.folderId != null && (typeof view.folderId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(view.folderId))) return { ok: false, error: 'Invalid Split view folder' };
+  if (view.favorite !== undefined && typeof view.favorite !== 'boolean') return { ok: false, error: 'Invalid Split view favorite' };
+  var name = validateName(view.name);
+  if (!name.ok) return name;
+  if (view.nameMode != null && ["automatic", "custom"].indexOf(view.nameMode) === -1) return { ok: false, error: "Split view name mode is invalid" };
+  if (!Number.isInteger(view.revision) || view.revision < 1 || !validatePreset(view.layout)) return { ok: false, error: "Split view revision or layout is invalid" };
+  var refs = view.sessionRefs;
+  if (!Array.isArray(refs) || refs.length < 2 || refs.length > MAX_SESSIONS) return { ok: false, error: "A Split view requires two to eight sessions" };
+  var ids = [];
+  for (var i = 0; i < refs.length; i++) {
+    var ref = refs[i];
+    if (!ref || !validOrigin(ref.originId) || ids.indexOf(ref.originId) !== -1 ||
+        !(ref.ownerId === null || typeof ref.ownerId === "string") ||
+        !(ref.linuxUser === null || typeof ref.linuxUser === "string")) return { ok: false, error: "Split view session references are invalid" };
+    ids.push(ref.originId);
+  }
+  var tree = validateTree(view.tree, ids);
+  if (!tree.ok) return tree;
+  if (typeof view.activeSessionOriginId !== "string" || ids.indexOf(view.activeSessionOriginId) === -1) return { ok: false, error: "Active session must belong to the Split view" };
+  return { ok: true, name: name.name, origins: ids };
+}
+
+module.exports = {
+  MAX_SESSIONS: MAX_SESSIONS,
+  MIN_RATIO: MIN_RATIO,
+  MAX_RATIO: MAX_RATIO,
+  PRESETS: PRESETS.slice(),
+  validOrigin: validOrigin,
+  validateTree: validateTree,
+  validateName: validateName,
+  validatePreset: validatePreset,
+  removeLeaf: removeLeaf,
+  createPreset: createPreset,
+  validateViewShape: validateViewShape,
+};

package/lib/users-workbench-layout-preferences.js

@@ -0,0 +1,33 @@
+// Account UI preferences are excluded from canonical Clay controls.
+function validMode(mode) { return mode === 'overlay' || mode === 'docked'; }
+function attachWorkbenchLayoutPreferences(deps) {
+  var config = deps.configModule || require('./config');
+  function context(accountId) {
+    var data = deps.loadUsers();
+    var user = data.users.find(function (entry) { return entry.id === accountId; });
+    if (deps.isMultiUser() ? !user : accountId !== 'default') throw new Error('Account unavailable.');
+    var settings = deps.isMultiUser() ? null : config.loadConfig() || {};
+    return { data: data, user: user, settings: settings, saved: settings ? settings.workbenchLayoutPreference : user.workbenchLayoutPreference };
+  }
+  function value(accountId, saved) {
+    if (saved === undefined) return { accountId: accountId, mode: 'overlay', revision: 0 };
+    if (!saved || !validMode(saved.mode) || !Number.isSafeInteger(saved.revision) || saved.revision < 1) throw new Error('Invalid stored preference.');
+    return { accountId: accountId, mode: saved.mode, revision: saved.revision };
+  }
+  function get(accountId) { return value(accountId, context(accountId).saved); }
+  function set(accountId, mode, revision) {
+    if (!validMode(mode) || !Number.isSafeInteger(revision) || revision < 0) return { status: 400, error: 'Invalid workbench layout.' };
+    var current = context(accountId), prior = value(accountId, current.saved);
+    if (prior.revision !== revision) return { status: 409, error: 'Workbench layout changed elsewhere. Reload the preference and try again.' };
+    if (prior.mode === mode) return prior;
+    if (revision === Number.MAX_SAFE_INTEGER) throw new Error('Preference revision exhausted.');
+    var saved = { mode: mode, revision: revision + 1 };
+    if (current.settings) config.saveConfig(Object.assign({}, current.settings, { workbenchLayoutPreference: saved }));
+    else deps.saveUsers(Object.assign({}, current.data, { users: current.data.users.map(function (entry) {
+      return entry === current.user ? Object.assign({}, entry, { workbenchLayoutPreference: saved }) : entry;
+    }) }));
+    return value(accountId, saved);
+  }
+  return { get: get, set: set };
+}
+module.exports = { attachWorkbenchLayoutPreferences: attachWorkbenchLayoutPreferences };

package/lib/users.js

@@ -333,6 +333,7 @@ var createUser = creation.createUser;
 var createUserWithoutPin = creation.createUserWithoutPin;
 var permissions = attachPermissions({ loadUsers: loadUsers, saveUsers: saveUsers, findUserById: findUserById });
 var contextualClayPreferences = require("./users-contextual-clay-preferences").attachContextualClayPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
+var workbenchLayoutPreferences = require('./users-workbench-layout-preferences').attachWorkbenchLayoutPreferences({ loadUsers: loadUsers, saveUsers: saveUsers, isMultiUser: auth.isMultiUser });
 var preferences = attachPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
 var projectMateFilterPreferences = attachProjectMateFilterPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
 var homeDockPreferences = attachHomeDockPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
@@ -479,6 +480,8 @@ module.exports = {
   setToolPalette: setToolPalette,
   getTerminalFont: getTerminalFont,
   setTerminalFont: setTerminalFont,
+  getWorkbenchLayoutPreference: workbenchLayoutPreferences.get,
+  setWorkbenchLayoutPreference: workbenchLayoutPreferences.set,
   getContextualClayGeometry: contextualClayPreferences.getContextualClayGeometry,
   setContextualClayGeometry: contextualClayPreferences.setContextualClayGeometry,
   getHomeDockPreference: getHomeDockPreference,

package/lib/workspace-query-service.js

@@ -100,11 +100,7 @@ var projection = createProjection({
   sessionRef: sessionRef,
 });
 
-function sessionActivity(session) {
-  if (session.isProcessing) return "processing";
-  if (session.pendingPermissions && Object.keys(session.pendingPermissions).length > 0) return "waiting_for_approval";
-  return "idle";
-}
+var sessionActivity = require('./session-activity-state').sessionActivity;
 
 function attachWorkspaceQueryService(ctx) {
   var getProjects = ctx.getProjects;

package/lib/ws-schema.js

@@ -59,6 +59,17 @@ var schema = {
   "split_group_rename":       { direction: "c2s", handler: "lib/session-split-groups.js", description: "Rename a split group" },
   "split_group_dissolve":     { direction: "c2s", handler: "lib/session-split-groups.js", description: "Separate a split group without deleting its sessions" },
   "split_group_set_pair":     { direction: "c2s", handler: "lib/session-split-groups.js", description: "Assign Driver/Worker roles on a split group (driverId null clears them)" },
+  "project_split_views_request": { direction: "c2s", handler: "lib/project-split-views.js", description: "Request the current owner's persisted presentation Split views for this project" },
+  "project_split_view_create": { direction: "c2s", handler: "lib/project-split-views.js", description: "Create a revision-checked presentation Split view from exact project session origins" },
+  "project_split_view_update": { direction: "c2s", handler: "lib/project-split-views.js", description: "Update exact Split view membership, layout tree and active session at the current owner revision" },
+  "project_split_view_rename": { direction: "c2s", handler: "lib/project-split-views.js", description: "Rename an exact presentation Split view at the current owner revision" },
+  "project_split_view_separate": { direction: "c2s", handler: "lib/project-split-views.js", description: "Remove a presentation Split view without changing its sessions or Driver/Worker pairing" },
+  "project_split_view_organize": { direction: "c2s", handler: "lib/project-split-views.js", description: "Organize an exact saved Split view in a live personal folder and Favorites at current revisions" },
+  "project_split_view_move": { direction: "c2s", handler: "lib/project-split-views.js", description: "Atomically move one exact session between presentation Split views or into a standalone target" },
+  "split_worker_conversation_request": { direction: "c2s", handler: "lib/project-worker-conversation.js", description: "Read a bounded transcript page for one exact owned Split Worker generation without switching sessions" },
+  "split_worker_conversation": { direction: "s2c", handler: "lib/public/modules/split-view-workers.js", description: "Read-only transcript page correlated to its exact Driver, Worker, and generation" },
+  "split_worker_remove": { direction: "c2s", handler: "lib/project-worker-removal.js", description: "Remove one exact owned Worker session, with a single-use human Stop confirmation when active" },
+  "split_worker_remove_result": { direction: "s2c", handler: "lib/public/modules/split-view-worker-removal.js", description: "Correlated observed removal or confirmation/failure for an exact Worker generation" },
   "split_worker_close":       { direction: "c2s", handler: "lib/project-pair-worker-close.js", description: "Close one exact authenticated Worker generation while preserving its peer and session history" },
   "split_worker_close_result": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Correlated result of an exact targeted Worker close" },
   "pair_session_options":     { direction: "c2s", handler: "lib/project-session-pair.js", description: "Request vendors/models for the pair-session dialog (response reuses the same type)" },
@@ -121,6 +132,8 @@ var schema = {
   "tui_transcript_state":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Assistant text index for a Claude TUI session (full replace; sent on request and after each new assistant message)" },
   "split_groups":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full persistent split-group list for the current user" },
   "split_group_result":       { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of a split-group mutation" },
+  "project_split_views": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Owner-scoped persisted presentation Split views for the current project" },
+  "project_split_view_result": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Correlated presentation Split view mutation result" },
   "pair_session_created":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of pair_session_create; carries the new group" },
   "worker_proposal":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Recorded Split Worker creation/replacement runtime card with Driver rationale" },
   "worker_proposal_update":   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Worker card lifecycle and manual/auto decision audit update" },
@@ -820,6 +833,8 @@ var schema = {
   "default_vendor_get":       { direction: "c2s", handler: "lib/server-default-vendor.js", description: "Read the authenticated user's New session vendor preference" },
   "default_vendor_set":       { direction: "c2s", handler: "lib/server-default-vendor.js", description: "Validate and persist the authenticated user's New session vendor preference" },
   "default_vendor_state":     { direction: "s2c", handler: "lib/public/modules/default-vendor.js", description: "Correlated or same-user-broadcast New session vendor preference" },
+  "clay_view_probe": { direction: "s2c", handler: "lib/public/modules/clay-split-view-screen.js", description: "Observe the exact owner window across stable frames" },
+  "clay_view_observed": { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Bounded correlated view observation, not approval" },
   "clay_ui_ready":            { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Advertise exact owner UI navigation support on this socket" },
   "clay_navigation_offer":    { direction: "s2c", handler: "lib/public/modules/clay-owner-navigation.js", description: "Offer one exact reviewed navigation to a selected owner connection" },
   "clay_navigation_claim":    { direction: "c2s", handler: "lib/server-owner-ui.js", description: "Claim an offered navigation with live source/target revalidation" },

package/lib/yoke/adapters/codex.js

@@ -1480,6 +1480,7 @@ function createCodexAdapter(opts) {
   var _recoveryIdleShutdown = null;
   var _activeQueries = [];
   var recoveryAdmission = require("../codex-recovery-admission").attachRecoveryAdmission({
+    timeoutMs: opts.recoveryAdmissionTimeoutMs,
     state: function() { return { epoch: _shutdownEpoch, shuttingDown: _shuttingDown, retiring: _recoveryIdleShutdown === _shutdownEpoch,
       initializing: _initializing, refCount: _refCount, server: _appServer, entries: _activeQueries.slice() }; },
     shutdownError: createShutdownError,

package/lib/yoke/codex-app-server.js

@@ -237,7 +237,9 @@ CodexAppServer.prototype._handleMessage = function(msg) {
       delete this.pendingRequests[msg.id];
       if (pending.timer) clearTimeout(pending.timer);
       if (msg.error) {
-        pending.reject(new Error(msg.error.message || JSON.stringify(msg.error)));
+        var rpcError = new Error(msg.error.message || JSON.stringify(msg.error));
+        rpcError.code = msg.error.code;
+        pending.reject(rpcError);
       } else {
         pending.resolve(msg.result);
       }

package/lib/yoke/codex-idle-recovery.js

@@ -21,24 +21,50 @@ function terminalsAreIdle(result) {
   });
 }
 
+function observe(checkCurrent, reason, method, rpcCode, threadId) {
+  if (typeof checkCurrent.observe === 'function') checkCurrent.observe(reason, method, rpcCode, threadId);
+}
+
+async function probe(server, method, params, timeout, checkCurrent) {
+  observe(checkCurrent, 'probe_started', method, null, params.threadId);
+  try {
+    var result = await server.send(method, params, timeout);
+    observe(checkCurrent, 'probe_returned', method, null, params.threadId);
+    return result;
+  } catch (error) {
+    observe(checkCurrent, 'probe_failed', method, error && Number.isInteger(error.code) ? error.code : null, params.threadId);
+    throw error;
+  }
+}
+
+function probeFailure(error, method) {
+  if (error && (error.code === -32601 || error.code === -32602)) {
+    var unsupported = new Error('Codex cannot verify recovery safety: ' + method + ' is unavailable or incompatible. No message was sent to the runtime.');
+    unsupported.code = 'CODEX_RECOVERY_PROBE_UNAVAILABLE';
+    throw unsupported;
+  }
+  return false;
+}
+
 async function retireIdleQueries(entries, server, checkCurrent) {
   checkCurrent();
   var candidates = [];
   for (var i = 0; i < entries.length; i++) {
     var handle = entries[i].handle;
     var snapshot = handle && handle.getIdleRecoverySnapshot && handle.getIdleRecoverySnapshot();
-    if (!snapshot) return false;
+    if (!snapshot) { observe(checkCurrent, 'idle_input_snapshot_unavailable', null, null, handle && handle.getRecoveryThreadId && handle.getRecoveryThreadId()); return false; }
     candidates.push({ handle: handle, snapshot: snapshot });
   }
   var safe = await Promise.all(candidates.map(function(candidate) {
-    return server.send("thread/backgroundTerminals/list", {
+    return probe(server, "thread/backgroundTerminals/list", {
       threadId: candidate.snapshot.threadId,
-    }, 5000).then(terminalsAreIdle, function() { return false; });
+    }, 5000, checkCurrent).then(terminalsAreIdle, function(error) { return probeFailure(error, 'thread/backgroundTerminals/list'); });
   }));
   checkCurrent();
   for (var ci = 0; ci < candidates.length; ci++) {
     var current = candidates[ci].handle.getIdleRecoverySnapshot();
-    if (!safe[ci] || !current || current.revision !== candidates[ci].snapshot.revision) return false;
+    if (!safe[ci]) { observe(checkCurrent, 'background_state_not_proven_idle', null, null, candidates[ci].snapshot.threadId); return false; }
+    if (!current || current.revision !== candidates[ci].snapshot.revision) { observe(checkCurrent, 'input_changed_during_probe', null, null, candidates[ci].snapshot.threadId); return false; }
   }
   // No awaits between validation and closing every input. A new send either
   // already invalidated its snapshot or sees a closed input and resumes anew.
@@ -58,33 +84,64 @@ async function loadedThreads(server, checkCurrent) {
   var deadline = Date.now() + 5000;
   for (var page = 0; page < 20; page++) {
     var remaining = deadline - Date.now();
-    if (remaining <= 0) return null;
+    if (remaining <= 0) { observe(checkCurrent, 'loaded_list_deadline'); return null; }
     var result;
     try {
-      result = await server.send('thread/loaded/list', { cursor: cursor, limit: 100 }, remaining);
+      result = await probe(server, 'thread/loaded/list', { cursor: cursor, limit: 100 }, remaining, checkCurrent);
     } catch (error) {
       checkCurrent();
       if (!server.started) throw error;
+      probeFailure(error, 'thread/loaded/list');
       return null;
     }
     checkCurrent();
-    if (!result || !Array.isArray(result.data) || !result.data.every(function(id) { return typeof id === 'string'; })) return null;
+    if (!result || !Array.isArray(result.data) || !result.data.every(function(id) { return typeof id === 'string'; })) { observe(checkCurrent, 'loaded_list_invalid'); return null; }
     threads = threads.concat(result.data);
     if (!result.nextCursor) return threads;
-    if (result.nextCursor === cursor) return null;
+    if (result.nextCursor === cursor) { observe(checkCurrent, 'loaded_list_cursor_repeated'); return null; }
     cursor = result.nextCursor;
   }
+  observe(checkCurrent, 'loaded_list_page_limit');
   return null;
 }
 
 async function threadIsAbsent(server, threadId, checkCurrent) {
   var threads = await loadedThreads(server, checkCurrent);
+  if (threads && threads.indexOf(threadId) !== -1) observe(checkCurrent, 'target_still_loaded', null, null, threadId);
   return !!threads && threads.indexOf(threadId) === -1;
 }
 
 async function runtimeCanStop(server, retiredThreads, checkCurrent) {
   var threads = await loadedThreads(server, checkCurrent);
-  return !!threads && threads.every(function(threadId) { return retiredThreads.indexOf(threadId) !== -1; });
+  if (!threads) return false;
+  // The caller has no live handles and holds admission. Closed handles can
+  // leave loaded threads that unsubscribe cannot release; prove every such
+  // thread idle before stopping their shared process, including siblings.
+  for (var threadId of threads) {
+    if (retiredThreads.indexOf(threadId) === -1 && !await threadIsIdle(server, threadId, checkCurrent)) return false;
+  }
+  checkCurrent();
+  return true;
+}
+
+async function threadIsIdle(server, threadId, checkCurrent) {
+  var method = 'thread/read';
+  try {
+    var status = await probe(server, method, { threadId: threadId, includeTurns: false }, 5000, checkCurrent);
+    checkCurrent();
+    if (!status || !status.thread || status.thread.id !== threadId
+        || !status.thread.status || status.thread.status.type !== 'idle') {
+      observe(checkCurrent, status && status.thread && status.thread.id === threadId && status.thread.status && status.thread.status.type === 'active'
+        ? 'provider_reports_active' : 'provider_idle_not_proven', method, null, threadId);
+      return false;
+    }
+    method = 'thread/backgroundTerminals/list';
+    var terminals = await probe(server, method, { threadId: threadId }, 5000, checkCurrent);
+    checkCurrent();
+    var idle = terminalsAreIdle(terminals);
+    if (!idle) observe(checkCurrent, 'background_state_not_proven_idle', method, null, threadId);
+    return idle;
+  } catch (error) { checkCurrent(); if (!server.started) throw error; return probeFailure(error, method); }
 }
 
 async function releaseThread(entries, server, threadId, checkCurrent) {
@@ -99,18 +156,14 @@ async function releaseThread(entries, server, threadId, checkCurrent) {
   } else {
     // A closed SDK handle can leave a loaded provider thread behind. Only an
     // explicitly idle provider thread with verified terminal state may unload.
-    try {
-      var status = await server.send('thread/read', { threadId: threadId, includeTurns: false }, 5000);
-      checkCurrent();
-      if (!status || !status.thread || status.thread.id !== threadId
-          || !status.thread.status || status.thread.status.type !== 'idle') return false;
-      var terminals = await server.send('thread/backgroundTerminals/list', { threadId: threadId }, 5000);
-      checkCurrent();
-      if (!terminalsAreIdle(terminals)) return false;
-    } catch (error) { checkCurrent(); if (!server.started) throw error; return false; }
+    if (!await threadIsIdle(server, threadId, checkCurrent)) return false;
+  }
+  try {
+    var result = await probe(server, 'thread/unsubscribe', { threadId: threadId }, 5000, checkCurrent);
+    var status = result && result.status;
+    observe(checkCurrent, ['unsubscribed', 'notSubscribed', 'notLoaded'].indexOf(status) !== -1 ? 'unsubscribe_' + status : 'unsubscribe_status_unknown', 'thread/unsubscribe', null, threadId);
   }
-  try { await server.send('thread/unsubscribe', { threadId: threadId }, 5000); }
-  catch (error) { checkCurrent(); if (!server.started) throw error; return false; }
+  catch (error) { checkCurrent(); if (!server.started) throw error; return probeFailure(error, 'thread/unsubscribe'); }
   return threadIsAbsent(server, threadId, checkCurrent);
 }
 

package/lib/yoke/codex-recovery-admission.js

@@ -1,4 +1,5 @@
 var idleRecovery = require('./codex-idle-recovery');
+var crypto = require('crypto');
 
 // Serialize decisions, not whole model turns. Waiting for a target must release
 // the gate so an unrelated Driver can still answer its Worker's permissions.
@@ -57,6 +58,8 @@ function attachRecoveryAdmission(ctx) {
     handoff = tail;
     tail.then(function() { if (handoff === tail) handoff = null; });
     try {
+      checkCurrent.phase('admission_gate');
+      if (prior) checkCurrent.observe('admission_gate_pending');
       await idleRecovery.wait(prior || Promise.resolve(), checkCurrent);
       await idleRecovery.wait(cleanup, checkCurrent);
       checkSharedExit();
@@ -69,8 +72,10 @@ function attachRecoveryAdmission(ctx) {
   }
 
   async function releaseTarget(threadId, checkCurrent) {
+    checkCurrent.phase('isolated_target');
     var prior = targets.get(threadId);
     if (!prior) return true;
+    checkCurrent.observe('isolated_target_reserved');
     if (cleanupFailures.has(prior)) throw cleanupFailures.get(prior);
     await prior.retireIdleForRecovery(checkCurrent);
     await cleanup;
@@ -80,8 +85,19 @@ function attachRecoveryAdmission(ctx) {
   }
 
   async function prepareShared(threadId, checkCurrent) {
+    checkCurrent.phase('shared_target');
     var state = ctx.state();
-    if (state.initializing) return false;
+    if (state.initializing) { checkCurrent.observe('shared_runtime_initializing'); return false; }
+    // Independent conversations do not participate in target handoff. Probing
+    // every idle sibling first can consume the whole admission budget even
+    // when this target can be unloaded immediately.
+    if (state.server && state.entries.some(function(entry) {
+      return !entry.handle || entry.handle.getRecoveryThreadId() !== threadId;
+    })) {
+      if (await idleRecovery.releaseThread(state.entries, state.server, threadId, checkCurrent)) return true;
+      checkCurrent();
+    }
+    checkCurrent.phase('shared_idle_retirement');
     var retiredThreads = [];
     if (state.refCount > 0) {
       var snapshots = state.entries.map(function(entry) { return entry.handle && entry.handle.getIdleRecoverySnapshot(); });
@@ -91,17 +107,52 @@ function attachRecoveryAdmission(ctx) {
     }
     state = ctx.state();
     if (!state.server) return true;
+    checkCurrent.phase('shared_runtime_release');
     if (!state.refCount && await idleRecovery.runtimeCanStop(state.server, retiredThreads, checkCurrent)) {
       var proc = state.server.proc;
       var stopped = await ctx.stopIdle();
       if (stopped) { unconfirmedSharedProcess = proc || null; checkSharedExit(); }
       return stopped;
     }
+    checkCurrent.phase('shared_target');
     return idleRecovery.releaseThread(state.entries, state.server, threadId, checkCurrent);
   }
 
   async function waitUntilAvailable(queryOpts, action) {
-    var checkCurrent = checker(queryOpts);
+    var checkLifecycle = checker(queryOpts);
+    var startedAt = Date.now();
+    var deadline = startedAt + (ctx.timeoutMs || 15000);
+    var admitted = false;
+    var observations = new Set();
+    var lastEvidence = null;
+    var ended = false;
+    var phase = 'admission_gate';
+    function targetKey(threadId) {
+      return crypto.createHash('sha256').update(String(threadId || queryOpts.resumeSessionId || '')).digest('hex').slice(0, 16);
+    }
+    checkCurrent.phase = function(value) { phase = value; };
+    function checkCurrent() {
+      checkLifecycle();
+      if (!admitted && Date.now() >= deadline) {
+        var error = new Error('Tool recovery could not verify that this conversation is safe to resume. No message was sent to the runtime. Review your retained messages and send again when the runtime is available.');
+        error.code = 'CODEX_RECOVERY_UNAVAILABLE';
+        throw error;
+      }
+    }
+    // Fixed evidence labels only: never log thread contents, RPC payloads,
+    // commands, credentials, or provider error strings. Bound polling noise.
+    checkCurrent.observe = function(reason, method, rpcCode, threadId) {
+      if (ended) return;
+      var evidence = { reason: reason, phase: phase, targetKey: targetKey(threadId), method: method || null, rpcCode: Number.isInteger(rpcCode) ? rpcCode : null };
+      lastEvidence = evidence;
+      var key = JSON.stringify(evidence);
+      if (observations.has(key) || observations.size >= 24) return;
+      observations.add(key);
+      if (typeof queryOpts.onRecoveryDiagnostic === 'function') {
+        try { queryOpts.onRecoveryDiagnostic(Object.assign({ elapsedMs: Date.now() - startedAt }, evidence)); } catch (error) {}
+      }
+    };
+    checkCurrent.admit = function() { checkCurrent(); admitted = true; };
     var waiting = false;
     if (typeof queryOpts.onRecoveryAdmission === 'function') queryOpts.onRecoveryAdmission(true);
     try {
@@ -119,6 +170,10 @@ function attachRecoveryAdmission(ctx) {
         await idleRecovery.wait(new Promise(function(resolve) { setTimeout(resolve, 50); }), checkCurrent);
       }
     } finally {
+      ended = true;
+      if (typeof queryOpts.onRecoveryDiagnostic === 'function') {
+        try { queryOpts.onRecoveryDiagnostic({ reason: admitted ? 'admission_granted' : 'admission_ended_without_grant', phase: phase, targetKey: targetKey(), elapsedMs: Date.now() - startedAt, lastEvidence: lastEvidence }); } catch (error) {}
+      }
       if (typeof queryOpts.onRecoveryAdmission === 'function') queryOpts.onRecoveryAdmission(false);
     }
   }
@@ -127,7 +182,9 @@ function attachRecoveryAdmission(ctx) {
     return waitUntilAvailable(queryOpts, async function(checkCurrent) {
       if (!await releaseTarget(queryOpts.resumeSessionId, checkCurrent)) return false;
       if (!await prepareShared(queryOpts.resumeSessionId, checkCurrent)) return false;
-      checkCurrent();
+      // Once ownership is reserved, normal startup/cleanup owns cancellation.
+      // A deadline must not discard a handle being created after admission.
+      checkCurrent.admit();
       var runtime = ctx.createRuntime(queryOpts);
       runtimes.push(runtime);
       targets.set(queryOpts.resumeSessionId, runtime);
@@ -149,7 +206,11 @@ function attachRecoveryAdmission(ctx) {
     checkSharedExit: checkSharedExit,
     hasTarget: function(threadId) { return targets.has(threadId); },
     waitForTarget: function(queryOpts) {
-      return waitUntilAvailable(queryOpts, function(checkCurrent) { return releaseTarget(queryOpts.resumeSessionId, checkCurrent); });
+      return waitUntilAvailable(queryOpts, async function(checkCurrent) {
+        var released = await releaseTarget(queryOpts.resumeSessionId, checkCurrent);
+        if (released) checkCurrent.admit();
+        return released;
+      });
     },
     shutdown: function() {
       return Promise.all(runtimes.slice().map(cleanupRuntime)).then(function(results) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "5.2.1-beta.1",
+  "version": "5.3.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"
@@ -9,7 +9,9 @@
     "dev": "node bin/cli.js --dev",
     "test": "node --test --test-force-exit --test-skip-pattern=\"^real sidebar (normal|long-turn):\" test/*.test.js",
     "semantic-release": "semantic-release",
-    "test:pane-performance": "node --test --test-force-exit test/pane-reuse-browser.test.js"
+    "test:pane-performance": "node --test --test-force-exit test/pane-reuse-browser.test.js",
+    "build:pane-assets": "node scripts/build-pane-assets.js",
+    "prepack": "npm run build:pane-assets"
   },
   "files": [
     "bin/",
@@ -86,6 +88,7 @@
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "semantic-release": "^25.0.3"
+    "semantic-release": "^25.0.3",
+    "esbuild": "0.28.2"
   }
 }