clay-server 5.3.0-beta.4 → 5.3.0-beta.6

package/lib/project-filesystem.js

@@ -45,13 +45,14 @@ function attachFilesystem(ctx) {
     // Resolve live authority before every operation; never trust message roles.
     if (/^fs_/.test(msg.type) && msg.type !== "fs_unwatch") {
       try {
+        if (msg.instanceId && (msg.projectSlug !== slug || (msg.accountId || null) !== (ws._clayUser && ws._clayUser.id || null))) throw new Error('File pane context changed');
         fileScope = access.fileScope(ws);
         if (/^fs_(list|read|write|watch)$/.test(msg.type)) {
           fileTarget = resolveFilePath(cwd, msg.type === "fs_list" ? msg.path || "." : msg.path, fileScope);
         }
       } catch (e) {
         var denied = fileError(e);
-        sendTo(ws, { type: msg.type + "_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, ok: false, error: denied.message, errorCode: denied.code });
+        sendTo(ws, { type: msg.type + "_result", path: msg.path, instanceId: msg.instanceId, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, ok: false, error: denied.message, errorCode: denied.code });
         return true;
       }
     }
@@ -115,7 +116,7 @@ function attachFilesystem(ctx) {
 
     // --- fs_read ---
     if (msg.type === "fs_read") {
-      var metadata = { type: 'fs_read_result', path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId };
+      var metadata = { type: 'fs_read_result', path: msg.path, instanceId: msg.instanceId, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId };
       try {
         var readResult = operations.read(fileScope, msg.path);
         try { var fileSnapshot = operations.snapshot(fileScope, msg.path); if (fileSnapshot.hash === require('crypto').createHash('sha256').update(readResult.content).digest('hex')) readResult.controlRevision = require('./clay-control-target-projection').digest(fileSnapshot); } catch (ignored) {}
@@ -210,12 +211,12 @@ function attachFilesystem(ctx) {
 
     // --- File watcher ---
     if (msg.type === "fs_watch") {
-      if (msg.path) startFileWatch(ws, msg.path);
+      if (msg.path) startFileWatch(ws, msg.path, msg.instanceId ? { instanceId: msg.instanceId, requestId: msg.requestId } : null);
       return true;
     }
 
     if (msg.type === "fs_unwatch") {
-      stopFileWatch(ws);
+      stopFileWatch(ws, msg.instanceId ? { instanceId: msg.instanceId, requestId: msg.requestId } : { instanceId: undefined, requestId: undefined });
       return true;
     }
 

package/lib/project-shared-browser.js

@@ -52,9 +52,13 @@ function attachSharedBrowser(ctx) {
     if (tabs.length > 1) throw new Error("Choose a browserId from status before operating a tab");
     return tabs[0] || null;
   }
+  function sendBrowserMessage(ws, session, message) {
+    var payload = require('./pane-session-transport').outbound(ws, message, session.localId);
+    if (payload) ctx.sendTo(ws, payload);
+  }
   function sendState(ws, session, record, present, focus) {
     if (!ws || ws.readyState !== 1 || !allowed(session, ws) || (record && !recordAllowed(record, ws))) return;
-    ctx.sendTo(ws, { type: "shared_browser_state", sessionId: session.localId, browser: projection(record), browsers: sessionRecords(session).map(projection), present: !!present, focus: !!focus });
+    sendBrowserMessage(ws, session, { type: "shared_browser_state", sessionId: session.localId, browser: projection(record), browsers: sessionRecords(session).map(projection), present: !!present, focus: !!focus });
   }
   function broadcast(record, present) {
     ctx.clients.forEach(function (ws) {
@@ -110,7 +114,7 @@ function attachSharedBrowser(ctx) {
       record.frame = { type: "shared_browser_frame", sessionId: record.session.localId, browserId: record.id,
         data: message.data, width: record.width, height: record.height };
       viewers.forEach(function (id, ws) {
-        if (watching(record, ws) && ws.bufferedAmount < 1024 * 1024) ctx.sendTo(ws, record.frame);
+        if (watching(record, ws) && ws.bufferedAmount < 1024 * 1024) sendBrowserMessage(ws, record.session, record.frame);
       });
       visibility(record);
     } else broadcast(record);
@@ -287,7 +291,7 @@ function attachSharedBrowser(ctx) {
       record = selectRecord(session, msg.browserId);
       if (!record || !recordAllowed(record, ws) || msg.browserId !== record.id) throw new Error("Browser session expired");
       if (msg.type === "shared_browser_view") {
-        if (msg.visible) { var previous = records.get(viewers.get(ws)); viewers.set(ws, record.id); if (previous && previous !== record) visibility(previous); if (record.frame) ctx.sendTo(ws, record.frame); }
+        if (msg.visible) { var previous = records.get(viewers.get(ws)); viewers.set(ws, record.id); if (previous && previous !== record) visibility(previous); if (record.frame) sendBrowserMessage(ws, record.session, record.frame); }
         else viewers.delete(ws);
         visibility(record);
       } else if (msg.type === "shared_browser_control") {

package/lib/project-split-view-document.js

@@ -1,9 +1,11 @@
 var layout = require("./split-view-layout");
+var workspace = require("./project-view-workspace");
 
 function validDocument(value) {
   if (!value || value.version !== 1 || !value.projects || typeof value.projects !== "object" || Array.isArray(value.projects)) return false;
   var projectSlugs = Object.keys(value.projects);
   for (var i = 0; i < projectSlugs.length; i++) {
+    if (["__proto__", "constructor", "prototype"].indexOf(projectSlugs[i]) >= 0) return false;
     var project = value.projects[projectSlugs[i]];
     if (!project || !project.owners || typeof project.owners !== "object" || Array.isArray(project.owners)) return false;
     var ownerKeys = Object.keys(project.owners);
@@ -11,7 +13,7 @@ function validDocument(value) {
       var record = project.owners[ownerKeys[j]];
       if (!record || !(record.ownerId === null || typeof record.ownerId === "string") ||
           !(record.linuxUser === null || typeof record.linuxUser === "string") ||
-          !Number.isInteger(record.revision) || record.revision < 0 || !Array.isArray(record.views)) return false;
+          !Number.isSafeInteger(record.revision) || record.revision < 0 || !Array.isArray(record.views)) return false;
       var ids = [], memberships = [];
       var ownerIdForKey = ownerKeys[j] === "default" ? null : ownerKeys[j].slice(5);
       if (ownerKeys[j] !== "default" && (ownerKeys[j].slice(0, 5) !== "user:" || !ownerIdForKey || ownerIdForKey !== record.ownerId)) return false;
@@ -25,9 +27,21 @@ function validDocument(value) {
           memberships.push(checked.origins[m]);
         }
       }
+      if (record.activeViewId != null && ids.indexOf(record.activeViewId) < 0) return false;
     }
   }
   return true;
 }
 
-module.exports = { validDocument: validDocument };
+// Normalize copies only. Legacy records keep their original revision and bytes
+// until an explicit mutation; no resource lookup or implicit migration write.
+function normalizeDocument(value) {
+  if (!validDocument(value)) throw new TypeError('Invalid saved View document');
+  var result = JSON.parse(JSON.stringify(value));
+  Object.keys(result.projects).forEach(function (slug) {
+    var owners = result.projects[slug].owners;
+    Object.keys(owners).forEach(function (key) { owners[key].views = owners[key].views.map(workspace.normalized); });
+  });
+  return result;
+}
+module.exports = { validDocument: validDocument, normalizeDocument: normalizeDocument };

package/lib/project-split-views.js

@@ -1,301 +1,15 @@
-var fs = require("fs");
-var path = require("path");
-var crypto = require("crypto");
 var layout = require("./split-view-layout");
 var names = require("./project-split-view-names");
 var sessionProvenance = require("./session-provenance");
 var validDocument = require("./project-split-view-document").validDocument;
+var createSplitViewsStore = require("./project-view-store").createSplitViewsStore;
+var workspace = require("./project-view-workspace");
 function clone(value) { return JSON.parse(JSON.stringify(value)); }
-function ownerKey(ownerId) { return ownerId == null ? "default" : "user:" + String(ownerId); }
-function emptyDocument() { return { version: 1, projects: {} }; }
-function emptyOwner(ownerId, linuxUser) { return { ownerId: ownerId == null ? null : String(ownerId), linuxUser: linuxUser || null, revision: 0, views: [] }; }
-function createSplitViewsStore(opts) {
-  var slug = opts.slug;
-  var sessionsDir = opts.sessionsDir;
-  var filePath = opts.filePath || path.join(sessionsDir, "presentation-split-views.json");
-  var fsImpl = opts.fs || fs;
-  var persist = opts.persist || null;
-  var document = emptyDocument();
-  var loadError = null;
-  try {
-    var loaded = JSON.parse(fsImpl.readFileSync(filePath, "utf8"));
-    if (!validDocument(loaded)) throw new Error("Stored Split view data is invalid");
-    document = loaded;
-  } catch (error) {
-    if (!error || error.code !== "ENOENT") loadError = error;
-  }
-  function projectRecord(source, create) {
-    if (!source.projects[slug] && create) source.projects[slug] = { owners: {} };
-    return source.projects[slug] || null;
-  }
-  function ownerRecord(source, ownerId, linuxUser, create) {
-    var project = projectRecord(source, create);
-    if (!project) return null;
-    var key = ownerKey(ownerId), record = project.owners[key];
-    if (!record && create) { record = emptyOwner(ownerId, linuxUser); project.owners[key] = record; }
-    if (record && (record.ownerId !== (ownerId == null ? null : String(ownerId)) || record.linuxUser !== (linuxUser || null))) return { identityMismatch: true };
-    return record || null;
-  }
-  function save(next) {
-    if (!validDocument(next)) throw new Error("Split view state failed validation");
-    var serialized = JSON.stringify(next, null, 2) + "\n";
-    if (persist) {
-      if (persist(filePath, serialized) === false) throw new Error("Split view persistence returned false");
-      return;
-    }
-    fsImpl.mkdirSync(sessionsDir, { recursive: true });
-    var tempPath = filePath + ".tmp." + process.pid + "." + crypto.randomBytes(4).toString("hex");
-    try {
-      fsImpl.writeFileSync(tempPath, serialized, { encoding: "utf8", flag: "wx", mode: 0o600 });
-      if (process.platform !== "win32") try { fsImpl.chmodSync(tempPath, 0o600); } catch (e) {}
-      fsImpl.renameSync(tempPath, filePath);
-    } catch (error) {
-      try { fsImpl.unlinkSync(tempPath); } catch (e) {}
-      throw error;
-    }
-  }
-  function state(ownerId, linuxUser) {
-    if (loadError) return { ok: false, error: "Stored Split view data could not be read; no changes were made", code: "storage", revision: 0, views: [] };
-    var record = ownerRecord(document, ownerId, linuxUser, false);
-    if (record && record.identityMismatch) return { ok: false, error: "Split view owner or OS identity changed", code: "identity", revision: 0, views: [] };
-    return record ? { ok: true, revision: record.revision, views: clone(record.views) } : { ok: true, revision: 0, views: [] };
-  }
-  function conflict(actual) { return { ok: false, error: "Split view state changed. Reload and try again.", code: "conflict", revision: actual }; }
-  function validateRevision(value) { return Number.isInteger(value) && value >= 0; }
-  function prepareRecord(ownerId, linuxUser, expectedRevision) {
-    var current = state(ownerId, linuxUser);
-    if (!current.ok) return current;
-    if (!validateRevision(expectedRevision) || expectedRevision !== current.revision) return conflict(current.revision);
-    var next = clone(document), record = ownerRecord(next, ownerId, linuxUser, true);
-    return { ok: true, next: next, record: record };
-  }
-  function commit(ownerId, record, changedView) {
-    record.revision++;
-    if (Array.isArray(changedView)) changedView.forEach(function (view) { if (view) view.revision = record.revision; });
-    else if (changedView) changedView.revision = record.revision;
-    try { save(documentForOwner(record, ownerId)); }
-    catch (error) { return { ok: false, error: error.message || String(error), code: "storage", revision: state(ownerId, record.linuxUser).revision }; }
-    document = documentForOwner(record, ownerId);
-    var resultView = Array.isArray(changedView) ? changedView[changedView.length - 1] : changedView;
-    return { ok: true, revision: record.revision, view: resultView ? clone(resultView) : null, views: clone(record.views) };
-  }
-  function documentForOwner(record, ownerId) {
-    var next = clone(document), project = projectRecord(next, true);
-    project.owners[ownerKey(ownerId)] = clone(record);
-    return next;
-  }
-  function validExpectedView(record, id) {
-    if (typeof id !== "string" || !id) return { error: "Split view not found" };
-    var index = record.views.findIndex(function (view) { return view.id === id; });
-    if (index === -1) return { error: "Split view not found" };
-    return { index: index, view: record.views[index] };
-  }
-  function refsFor(origins, resolvedRefs) {
-    if (!Array.isArray(origins) || origins.length < 2 || origins.length > layout.MAX_SESSIONS ||
-        origins.some(function (origin) { return !layout.validOrigin(origin); }) || new Set(origins).size !== origins.length) return { error: "A Split view requires two to eight unique session origins" };
-    if (!Array.isArray(resolvedRefs) || resolvedRefs.length !== origins.length) return { error: "One or more exact sessions could not be resolved" };
-    var refs = [];
-    for (var i = 0; i < origins.length; i++) {
-      var ref = resolvedRefs.find(function (item) { return item && item.originId === origins[i]; });
-      if (!ref) return { error: "One or more exact sessions could not be resolved" };
-      refs.push({ originId: ref.originId, ownerId: ref.ownerId == null ? null : String(ref.ownerId), linuxUser: ref.linuxUser || null });
-    }
-    return { refs: refs };
-  }
-  function validateComposition(input, refs) {
-    var origins = refs.map(function (ref) { return ref.originId; }), tree = layout.validateTree(input.tree, origins), preset = input.layout;
-    if (!tree.ok) return { error: tree.error };
-    if (!layout.validatePreset(preset)) return { error: "Unknown Split view layout" };
-    if (typeof input.activeSessionOriginId !== "string" || origins.indexOf(input.activeSessionOriginId) === -1) return { error: "Active session must belong to the Split view" };
-    return { origins: origins };
-  }
-  function uniqueMembership(views, refs, exceptId, secondExceptId) {
-    var used = [];
-    views.forEach(function (view) {
-      if (view.id === exceptId || view.id === secondExceptId) return;
-      view.sessionRefs.forEach(function (ref) { used.push(ref.originId); });
-    });
-    return refs.every(function (ref) { return used.indexOf(ref.originId) === -1; });
-  }
-  function create(ownerId, linuxUser, input, resolvedRefs) {
-    input = input || {};
-    var prepared = prepareRecord(ownerId, linuxUser, input.expectedRevision);
-    if (!prepared.ok) return prepared;
-    var name = layout.validateName(input.name), refs = refsFor(input.sessionOrigins, resolvedRefs);
-    if (!name.ok) return name;
-    if (refs.error) return { ok: false, error: refs.error };
-    var composition = validateComposition(input, refs.refs);
-    if (composition.error) return { ok: false, error: composition.error };
-    if (!uniqueMembership(prepared.record.views, refs.refs)) return { ok: false, error: "A session can belong to only one Split view" };
-    var nameMode = input.nameMode === "custom" ? "custom" : "automatic";
-    var view = { id: crypto.randomUUID(), name: nameMode === "automatic" ? names.automaticName(input.liveSessions) : name.name, nameMode: nameMode,
-      folderId: null, favorite: false, revision: prepared.record.revision + 1, layout: input.layout,
-      activeSessionOriginId: input.activeSessionOriginId, tree: clone(input.tree), sessionRefs: refs.refs };
-    prepared.record.views.push(view);
-    return commit(ownerId, prepared.record, view);
-  }
-  function update(ownerId, linuxUser, input, resolvedRefs) {
-    input = input || {};
-    var prepared = prepareRecord(ownerId, linuxUser, input.expectedRevision);
-    if (!prepared.ok) return prepared;
-    var found = validExpectedView(prepared.record, input.id, input.expectedRevision);
-    if (found.error) return { ok: false, error: found.error };
-    if (found.conflict) return conflict(found.revision);
-    var refs = refsFor(input.sessionOrigins, resolvedRefs);
-    if (refs.error) return { ok: false, error: refs.error };
-    var ordered = names.update(found.view, refs.refs, input.liveSessions);
-    if (!ordered) return { ok: false, error: "One or more exact sessions could not be resolved" };
-    refs.refs = ordered.refs; input.liveSessions = ordered.sessions;
-    var composition = validateComposition(input, refs.refs);
-    if (composition.error) return { ok: false, error: composition.error };
-    if (!uniqueMembership(prepared.record.views, refs.refs, input.id)) return { ok: false, error: "A session can belong to only one Split view" };
-    if (names.mode(found.view) === "automatic") found.view.name = names.automaticName(input.liveSessions);
-    found.view.layout = input.layout; found.view.activeSessionOriginId = input.activeSessionOriginId;
-    found.view.tree = clone(input.tree); found.view.sessionRefs = refs.refs;
-    return commit(ownerId, prepared.record, found.view);
-  }
-  function rename(ownerId, linuxUser, input) {
-    input = input || {};
-    var prepared = prepareRecord(ownerId, linuxUser, input.expectedRevision);
-    if (!prepared.ok) return prepared;
-    var found = validExpectedView(prepared.record, input.id, input.expectedRevision);
-    if (found.error) return { ok: false, error: found.error };
-    if (found.conflict) return conflict(found.revision);
-    var name = layout.validateName(input.name);
-    if (!name.ok) return name;
-    found.view.name = name.name;
-    found.view.nameMode = "custom";
-    return commit(ownerId, prepared.record, found.view);
-  }
-  function separate(ownerId, linuxUser, input) {
-    input = input || {};
-    var prepared = prepareRecord(ownerId, linuxUser, input.expectedRevision);
-    if (!prepared.ok) return prepared;
-    var found = validExpectedView(prepared.record, input.id, input.expectedRevision);
-    if (found.error) return { ok: false, error: found.error };
-    if (found.conflict) return conflict(found.revision);
-    var removed = prepared.record.views.splice(found.index, 1)[0];
-    return commit(ownerId, prepared.record, null);
-  }
-  function move(ownerId, linuxUser, input, resolvedSourceRefs, resolvedTargetRefs) {
-    input = input || {};
-    var prepared = prepareRecord(ownerId, linuxUser, input.expectedRevision);
-    if (!prepared.ok) return prepared;
-    if (typeof input.sourceSessionOriginId !== "string" || !layout.validOrigin(input.sourceSessionOriginId)) return { ok: false, error: "A valid source session is required", code: "invalid" };
-    var source = validExpectedView(prepared.record, input.sourceViewId);
-    if (source.error) return { ok: false, error: "Source Split view not found", code: "not_found", revision: prepared.record.revision };
-    var sourceOrigins = source.view.sessionRefs.map(function (ref) { return ref.originId; });
-    if (sourceOrigins.indexOf(input.sourceSessionOriginId) === -1) return { ok: false, error: "Source session does not belong to the source Split view", code: "session", revision: prepared.record.revision };
-    if (!Array.isArray(resolvedSourceRefs) || resolvedSourceRefs.length !== source.view.sessionRefs.length) return { ok: false, error: "Source sessions could not be resolved", code: "session", revision: prepared.record.revision };
-    for (var i = 0; i < source.view.sessionRefs.length; i++) {
-      var storedSource = source.view.sessionRefs[i], liveSource = resolvedSourceRefs.find(function (ref) { return ref && ref.originId === storedSource.originId; });
-      if (!liveSource || (liveSource.ownerId || null) !== (storedSource.ownerId || null) || (liveSource.linuxUser || null) !== (storedSource.linuxUser || null)) {
-        return { ok: false, error: "A source session was replaced or changed identity", code: "session", revision: prepared.record.revision };
-      }
-    }
-    var target = null, targetSessionOriginId = input.targetSessionOriginId;
-    var hasTargetView = typeof input.targetViewId === "string" && input.targetViewId.length > 0;
-    var hasStandaloneTarget = typeof targetSessionOriginId === "string" && layout.validOrigin(targetSessionOriginId);
-    if (hasTargetView === hasStandaloneTarget || (input.targetViewId != null && !hasTargetView)) {
-      return { ok: false, error: "Choose exactly one target Split view or standalone session", code: "invalid", revision: prepared.record.revision };
-    }
-    if (hasTargetView) {
-      target = validExpectedView(prepared.record, input.targetViewId);
-      if (target.error || target.view.id === source.view.id) return { ok: false, error: "Target Split view is unavailable", code: "not_found", revision: prepared.record.revision };
-    }
-    if (Array.isArray(input.targetSessionOrigins) && input.targetSessionOrigins.length > layout.MAX_SESSIONS) {
-      return { ok: false, error: "A Split view can contain at most eight sessions", code: "limit", revision: prepared.record.revision };
-    }
-    var targetRefs = refsFor(input.targetSessionOrigins, resolvedTargetRefs);
-    if (targetRefs.error) return { ok: false, error: targetRefs.error, code: "session", revision: prepared.record.revision };
-    var requestedTargetOrigins = targetRefs.refs.map(function (ref) { return ref.originId; });
-    if (requestedTargetOrigins.indexOf(input.sourceSessionOriginId) === -1) return { ok: false, error: "Target layout must include the moved source session", code: "invalid", revision: prepared.record.revision };
-    if (target) {
-      var requestedPriorOrigins = target.view.sessionRefs.map(function (ref) { return ref.originId; });
-      if (requestedTargetOrigins.length !== requestedPriorOrigins.length + 1 || requestedPriorOrigins.some(function (origin) { return requestedTargetOrigins.indexOf(origin) === -1; })) {
-        return { ok: false, error: "Target layout must preserve every existing target session", code: "invalid", revision: prepared.record.revision };
-      }
-      if (!uniqueMembership(prepared.record.views, targetRefs.refs, target.view.id, source.view.id)) return { ok: false, error: "A target session belongs to another Split view", code: "membership", revision: prepared.record.revision };
-    } else if (targetSessionOriginId === input.sourceSessionOriginId || requestedTargetOrigins.length !== 2 || requestedTargetOrigins.indexOf(targetSessionOriginId) === -1) {
-      return { ok: false, error: "A standalone target transfer requires exactly the target and moved sessions", code: "invalid", revision: prepared.record.revision };
-    } else if (!uniqueMembership(prepared.record.views, targetRefs.refs, source.view.id)) {
-      return { ok: false, error: "A standalone target session already belongs to a Split view", code: "membership", revision: prepared.record.revision };
-    }
-    if (target) { var orderedTarget = names.append(target.view, targetRefs.refs, input.liveSessions, input.sourceSessionOriginId);
-      if (!orderedTarget) return { ok: false, error: "Target layout must preserve existing sessions and include the moved source exactly once", code: "invalid", revision: prepared.record.revision };
-      targetRefs.refs = orderedTarget.refs; input.liveSessions = orderedTarget.sessions; }
-    else { var orderedStandalone = names.targetFirst(targetRefs.refs, input.liveSessions, targetSessionOriginId, input.sourceSessionOriginId);
-      if (!orderedStandalone) return { ok: false, error: "A standalone target transfer requires exactly the target and moved sessions", code: "invalid", revision: prepared.record.revision };
-      targetRefs.refs = orderedStandalone.refs; input.liveSessions = orderedStandalone.sessions; }
-    var targetOrigins = targetRefs.refs.map(function (ref) { return ref.originId; });
-    if (!layout.validatePreset(input.layout) || !layout.validateTree(input.tree, targetOrigins).ok || targetOrigins.length > layout.MAX_SESSIONS) {
-      return { ok: false, error: "Target layout is invalid or exceeds the eight-session limit", code: targetOrigins.length > layout.MAX_SESSIONS ? "limit" : "invalid", revision: prepared.record.revision };
-    }
-    if (typeof input.activeSessionOriginId !== "string" || targetOrigins.indexOf(input.activeSessionOriginId) === -1) {
-      return { ok: false, error: "Active session must belong to the target Split view", code: "invalid", revision: prepared.record.revision };
-    }
-    if (!target) {
-      var name = layout.validateName(input.name);
-      if (!name.ok) return { ok: false, error: name.error, code: "invalid", revision: prepared.record.revision };
-    }
-    var nextSourceOrigins = sourceOrigins.filter(function (origin) { return origin !== input.sourceSessionOriginId; });
-    source.view.tree = layout.removeLeaf(source.view.tree, input.sourceSessionOriginId);
-    source.view.sessionRefs = source.view.sessionRefs.filter(function (ref) { return ref.originId !== input.sourceSessionOriginId; });
-    if (source.view.activeSessionOriginId === input.sourceSessionOriginId && nextSourceOrigins.length) source.view.activeSessionOriginId = nextSourceOrigins[0];
-    if (nextSourceOrigins.length < 2) prepared.record.views.splice(source.index, 1);
-    if (nextSourceOrigins.length >= 2 && names.mode(source.view) === "automatic") source.view.name = names.automaticName(input.sourceLiveSessions.filter(function (session) { return session.sessionOriginId !== input.sourceSessionOriginId; }));
-    if (target) {
-      target.view.tree = clone(input.tree); target.view.layout = input.layout;
-      target.view.activeSessionOriginId = input.activeSessionOriginId; target.view.sessionRefs = targetRefs.refs;
-      if (names.mode(target.view) === "automatic") target.view.name = names.automaticName(input.liveSessions);
-    } else {
-      target = { index: -1, view: { id: crypto.randomUUID(), folderId: null, favorite: false, name: names.automaticName(input.liveSessions), nameMode: "automatic", revision: prepared.record.revision + 1,
-        layout: input.layout, activeSessionOriginId: input.activeSessionOriginId, tree: clone(input.tree), sessionRefs: targetRefs.refs } };
-      prepared.record.views.push(target.view);
-    }
-    var changed = [target.view];
-    if (nextSourceOrigins.length >= 2) changed.unshift(source.view);
-    return commit(ownerId, prepared.record, changed);
-  }
-  function removeOrigin(originId) {
-    var project = projectRecord(document, false), changedOwners = [], failures = [];
-    if (!project) return { owners: changedOwners, failures: failures };
-    var keys = Object.keys(project.owners);
-    for (var i = 0; i < keys.length; i++) {
-      var source = project.owners[keys[i]], next = clone(source), changed = false, retained = [];
-      for (var j = 0; j < next.views.length; j++) {
-        var view = next.views[j], member = view.sessionRefs.some(function (ref) { return ref.originId === originId; });
-        if (!member) { retained.push(view); continue; }
-        changed = true;
-        var tree = layout.removeLeaf(view.tree, originId), origins = view.sessionRefs.filter(function (ref) { return ref.originId !== originId; });
-        if (origins.length < 2) continue;
-        view.tree = tree;
-        view.sessionRefs = origins;
-        if (view.activeSessionOriginId === originId) view.activeSessionOriginId = origins[0].originId;
-        retained.push(view);
-      }
-      if (!changed) continue;
-      next.views = retained;
-      next.revision++;
-      next.views.forEach(function (view) { view.revision = next.revision; });
-      try {
-        var replacement = documentForOwner(next, source.ownerId);
-        save(replacement);
-        document = replacement;
-        changedOwners.push(source.ownerId);
-      } catch (error) { failures.push({ ownerId: source.ownerId, error: error.message || String(error) }); }
-    }
-    return { owners: changedOwners, failures: failures };
-  }
-  var organization = require('./project-split-view-organization').attachOrganization({ prepare: prepareRecord, commit: commit, state: state });
-  return { organize: organization.organize, reconcileFolders: organization.reconcileFolders, state: state, create: create, update: update, rename: rename, separate: separate, move: move, removeOrigin: removeOrigin,
-    get filePath() { return filePath; }, get loadError() { return loadError; } };
-}
 function attachProjectSplitViews(ctx) {
   var store = createSplitViewsStore({ sessionsDir: ctx.sm.sessionsDir, slug: ctx.slug, persist: ctx.persist });
   var users = ctx.usersModule;
   function actor(ws) {
-    if (ctx.isMate || !ws || !ctx.clients.has(ws) || ws._clayPaneActivation || !ctx.canAccessProject(ws)) return null;
+    if (ctx.isMate || !ws || ws.readyState !== 1 || !ctx.clients.has(ws) || ws._clayPaneActivation || !ctx.canAccessProject(ws)) return null;
     if (users.isMultiUser()) {
       var user = ws._clayUser && users.findUserById(ws._clayUser.id);
       if (!user || !ctx.canAccessProject(ws)) return null;
@@ -320,7 +34,7 @@ function attachProjectSplitViews(ctx) {
     return { session: found, ref: { originId: found.sessionOriginId, ownerId: found.ownerId || null, linuxUser: linuxUser || null } };
   }
   function resolvedRefs(ws, origins) {
-    if (!Array.isArray(origins) || origins.length < 2) return { error: "A Split view requires two to eight sessions", code: "invalid" };
+    if (!Array.isArray(origins)) return { error: "View session origins must be an array", code: "invalid" };
     if (origins.length > layout.MAX_SESSIONS) return { error: "A Split view can contain at most eight sessions", code: "limit" };
     if (new Set(origins).size !== origins.length || origins.some(function (origin) { return !layout.validOrigin(origin); })) return { error: "Split view session origins must be unique valid values", code: "invalid" };
     var refs = [], sessions = [];
@@ -353,7 +67,7 @@ function attachProjectSplitViews(ctx) {
           (resolved.ref.linuxUser || null) !== (stored.linuxUser || null)) return null;
       refs.push({ id: resolved.session.localId, sessionOriginId: resolved.session.sessionOriginId, title: resolved.session.title || "" });
     }
-    var projected = names.project(view, refs); projected.tree = clone(view.tree); return projected;
+    var projected = names.project(view, refs); projected.tree = clone(view.tree); projected.workspace = workspace.normalized(view).workspace; return projected;
   }
   function folderIds(ownerId) {
     var accountId = users.isMultiUser() ? ownerId : 'default';
@@ -365,12 +79,12 @@ function attachProjectSplitViews(ctx) {
     var state = store.reconcileFolders(current.id, current.linuxUser, folderIds(current.id));
     if (!state.ok) return { owner: current, revision: state.revision, views: [], error: state.error };
     var views = state.views.map(function (view) { return visibleView(ws, view); }).filter(Boolean);
-    return { owner: current, revision: state.revision, views: views };
+    return { owner: current, revision: state.revision, activeViewId: state.activeViewId || null, views: views };
   }
   function sendState(ws) {
     var state = stateFor(ws);
     if (!state) return false;
-    ctx.sendTo(ws, { type: "project_split_views", projectSlug: ctx.slug, revision: state.revision, views: state.views, error: state.error || null });
+    ctx.sendTo(ws, { type: "project_split_views", projectSlug: ctx.slug, revision: state.revision, activeViewId: state.activeViewId || null, views: state.views, error: state.error || null });
     return true;
   }
   function broadcastOwner(ownerId) {
@@ -405,15 +119,21 @@ function attachProjectSplitViews(ctx) {
     function execute(action, input) {
       var current = currentActor(), result;
       if (!current) return { ok: false, error: "Split view access is no longer permitted", code: "forbidden" };
-      input = input || {};
+      input = Object.assign({}, input || {});
+      var identity = require("./project-view-input").check(input, ctx.slug, current.id, input.workspace !== undefined);
+      if (!identity.ok) return identity;
       var currentState = store.state(current.id, current.linuxUser);
       if (!currentState.ok) return currentState;
       if (!Number.isInteger(input.expectedRevision) || input.expectedRevision !== currentState.revision) {
         return { ok: false, error: "Split view state changed. Reload and try again.", code: "conflict", revision: currentState.revision };
       }
+      var targetId = action === "move" ? input.sourceViewId : input.id;
+      var target = currentState.views.find(function (view) { return view.id === targetId; });
+      if (target && input.expectedViewRevision !== undefined && target.revision !== input.expectedViewRevision) return { ok: false, code: "conflict", error: "View revision changed. Reload and try again." };
       if (action === "create" || action === "update") {
         var refs = resolvedRefs(ws, input.sessionOrigins);
         if (!refs.refs) return refs;
+        if (input.workspace && !require('./project-view-pair').authorized(ctx, ws, input.workspace.linkedPair)) return { ok: false, code: 'pair', error: 'The exact linked Worker pair is unavailable.' };
         input.liveSessions = refs.sessions;
         if (action === "update") {
           var exact = verifyStoredView(ws, current, input.id);
@@ -437,6 +157,7 @@ function attachProjectSplitViews(ctx) {
         }
         var targetResolved = resolvedRefs(ws, input.targetSessionOrigins);
         if (!targetResolved.refs) return targetResolved;
+        if (input.targetWorkspace && !require('./project-view-pair').authorized(ctx, ws, input.targetWorkspace.linkedPair)) return { ok: false, code: 'pair', error: 'The exact linked Worker pair is unavailable.' };
         input.liveSessions = targetResolved.sessions;
         return store.move(current.id, current.linuxUser, input, sourceResolved.refs, targetResolved.refs);
       }

package/lib/project-user-message.js

@@ -270,12 +270,13 @@ function attachUserMessage(ctx) {
         return true;
       }
       tm.attach(t.id, ws);
-      send({ type: "term_list", terminals: tm.list() });
+      send({ type: "term_list", terminals: tm.list(true) });
       sendTo(ws, { type: "term_created", id: t.id });
       return true;
     }
 
     if (msg.type === "term_attach") {
+      if (require("./project-view-terminal-binding").attachSaved(ctx, ws, msg)) return true;
       if (msg.id) tm.attach(msg.id, ws);
       return true;
     }
@@ -300,7 +301,7 @@ function attachUserMessage(ctx) {
     if (msg.type === "term_close") {
       if (msg.id) {
         tm.close(msg.id);
-        send({ type: "term_list", terminals: tm.list() });
+        send({ type: "term_list", terminals: tm.list(true) });
         // Remove closed terminal from context sources
         var _termSessionId = ws._clayActiveSession || null;
         var saved = loadContextSources(slug, _termSessionId);
@@ -317,7 +318,7 @@ function attachUserMessage(ctx) {
     if (msg.type === "term_rename") {
       if (msg.id && msg.title) {
         tm.rename(msg.id, msg.title);
-        send({ type: "term_list", terminals: tm.list() });
+        send({ type: "term_list", terminals: tm.list(true) });
       }
       return true;
     }

package/lib/project-vendor-login.js

@@ -163,7 +163,7 @@ function attachVendorLogin(ctx) {
     if (!flow || typeof flow.terminalId !== "number") return;
     flow.closing = true;
     try { tm.close(flow.terminalId); } catch (e) {}
-    send({ type: "term_list", terminals: tm.list() });
+    send({ type: "term_list", terminals: tm.list(true) });
   }
 
   // Restart the vendor adapter so the next query spawns a process that reads
@@ -299,7 +299,7 @@ function attachVendorLogin(ctx) {
 
     flow.terminalId = terminal.id;
     if (!flow.browser) tm.attach(terminal.id, ws);
-    send({ type: "term_list", terminals: tm.list() });
+    send({ type: "term_list", terminals: tm.list(true) });
     return flow;
   }
 

package/lib/project-view-input.js

@@ -0,0 +1,11 @@
+function check(input, slug, ownerId, extended, view) {
+  if (input.projectSlug !== undefined && input.projectSlug !== slug || input.accountId !== undefined && input.accountId !== ownerId ||
+      extended && (input.projectSlug !== slug || input.accountId !== ownerId)) {
+    return { ok: false, code: 'identity', error: 'View account or project identity does not match' };
+  }
+  if (view && (extended || input.expectedViewRevision !== undefined) && input.expectedViewRevision !== view.revision) {
+    return { ok: false, code: 'conflict', error: 'View revision changed. Reload and try again.' };
+  }
+  return { ok: true };
+}
+module.exports = { check: check };

package/lib/project-view-pair.js

@@ -0,0 +1,26 @@
+// Pair presentation is UI state, never Worker membership or execution authority.
+function valid(pair, value, view) {
+  if (!pair || Object.keys(pair).sort().join(',') !== 'driverOriginId,groupId,tree,workerOrigins' || typeof pair.groupId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(pair.groupId) ||
+      !view.sessionRefs.some(function (r) { return r.originId === pair.driverOriginId; }) || !Array.isArray(pair.workerOrigins) || !pair.workerOrigins.length || pair.workerOrigins.length + view.sessionRefs.length > 8 || new Set(pair.workerOrigins).size !== pair.workerOrigins.length || pair.workerOrigins.indexOf(pair.driverOriginId) >= 0 || pair.workerOrigins.some(function (id) { return typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(id); })) return false;
+  var mapping = {}, expected = pair.workerOrigins.slice();
+  value.panes.forEach(function (p) { if (!p.open || p.placement !== 'docked') return; var id = p.kind === 'session' ? p.resource.originId : 'tool-' + (p.kind === 'workbench' ? p.resource.name : p.kind === 'file' ? 'file-' + p.instanceId : p.kind); mapping[id] = p.instanceId; expected.push(id); });
+  var count = 0, seen = [];
+  function walk(n) { if (!n || ++count > 47) return false; if (Object.keys(n).join(',') === 'id') { seen.push(n.id); return expected.indexOf(n.id) >= 0; } return Object.keys(n).sort().join(',') === 'axis,left,ratio,right' && ['horizontal','vertical'].indexOf(n.axis) >= 0 && Number.isFinite(n.ratio) && n.ratio >= .05 && n.ratio <= .95 && walk(n.left) && walk(n.right); }
+  function project(n) { if (!n) return null; if (n.id) return mapping[n.id] ? { id: mapping[n.id] } : null; var l = project(n.left), r = project(n.right); return !l ? r : !r ? l : { axis:n.axis,ratio:n.ratio,left:l,right:r }; }
+  function same(a,b) { return !a || !b ? a === b : a.id || b.id ? a.id === b.id : a.axis === b.axis && a.ratio === b.ratio && same(a.left,b.left) && same(a.right,b.right); }
+  return expected.length <= 24 && walk(pair.tree) && seen.length === expected.length && new Set(seen).size === seen.length && same(project(pair.tree),value.tree);
+}
+function authorized(ctx, ws, pair) {
+  if (!pair) return true;
+  if (typeof pair !== 'object' || !Array.isArray(pair.workerOrigins)) return false;
+  var driver;
+  ctx.sm.sessions.forEach(function (s) { if (s.sessionOriginId === pair.driverOriginId) driver = s; });
+  var group = driver && ctx.getViewPairGroup && ctx.getViewPairGroup(driver.localId);
+  // The registry's pair fields support legacy and current Worker lists.
+  var p = group && group.pair, ids = p && (p.workerIds || [p.workerId]);
+  return !!(driver && (driver.ownerId || null) === (ws._clayUser && ws._clayUser.id || null) && group && group.id === pair.groupId && p && p.driverId === driver.localId && ids.length === pair.workerOrigins.length && ids.every(function (id, i) {
+    var s = ctx.sm.sessions.get(id);
+    return s && (s.ownerId || null) === (driver.ownerId || null) && require('./session-provenance').isWorker(s) && s.sessionProvenance.parentSessionOriginId === driver.sessionOriginId && s.sessionOriginId === pair.workerOrigins[i] && ctx.canAccessSession(ws,s);
+  }));
+}
+module.exports = { valid: valid, authorized: authorized };