clay-server 2.11.0-beta.2 → 2.11.0-beta.20

package/bin/cli.js

@@ -62,6 +62,7 @@ var headlessMode = false;
 var watchMode = false;
 var host = null;
 var multiUserMode = false;
+var osUsersMode = false;
 
 for (var i = 0; i < args.length; i++) {
   if (args[i] === "-p" || args[i] === "--port") {
@@ -108,6 +109,8 @@ for (var i = 0; i < args.length; i++) {
     dangerouslySkipPermissions = true;
   } else if (args[i] === "--multi-user") {
     multiUserMode = true;
+  } else if (args[i] === "--os-users") {
+    osUsersMode = true;
   } else if (args[i] === "-h" || args[i] === "--help") {
     console.log("Usage: clay-server [-p|--port <port>] [--host <address>] [--no-https] [--no-update] [--debug] [-y|--yes] [--pin <pin>] [--shutdown] [--restart]");
     console.log("       clay-server --add <path>     Add a project to the running daemon");
@@ -128,7 +131,8 @@ for (var i = 0; i < args.length; i++) {
     console.log("  --remove <path>    Remove a project directory");
     console.log("  --list             List all registered projects");
     console.log("  --headless         Start daemon and exit immediately (implies --yes)");
-    console.log("  --multi-user       Enable multi-user mode (generates setup code)");
+    console.log("  --multi-user       Start in multi-user mode (use with --yes for headless)");
+    console.log("  --os-users         Enable OS-level user isolation (Linux, requires root + --multi-user)");
     console.log("  --dangerously-skip-permissions");
     console.log("                     Bypass all permission prompts");
     process.exit(0);
@@ -267,33 +271,8 @@ if (listMode) {
   return;
 }
 
-// --- Handle --multi-user before anything else ---
-if (multiUserMode) {
-  var muResult = enableMultiUser();
-  if (muResult.alreadyEnabled && muResult.hasAdmin) {
-    console.log("");
-    console.log("Multi-user mode is already enabled and an admin account exists.");
-    console.log("No changes made.");
-    console.log("");
-  } else if (muResult.setupCode) {
-    console.log("");
-    console.log("\x1b[33m⚠ Experimental Feature\x1b[0m");
-    console.log("");
-    console.log("  Multi-user mode is experimental and may change in future releases.");
-    console.log("  Sharing access to AI-powered tools may be subject to your provider's");
-    console.log("  terms of service. Please review the applicable usage policies before");
-    console.log("  granting access to other users.");
-    console.log("");
-    console.log("\x1b[32mMulti-user mode enabled.\x1b[0m");
-    console.log("");
-    console.log("Setup code:  \x1b[1m" + muResult.setupCode + "\x1b[0m");
-    console.log("");
-    console.log("Open Clay in your browser and enter this code to create the admin account.");
-    console.log("The code is single-use and will be cleared once the admin is set up.");
-    console.log("");
-  }
-  process.exit(0);
-}
+// --multi-user / --os-users are now handled in the main entry flow (setup wizard or repeat run)
+// Flags are parsed above and applied during forkDaemon()
 
 var cwd = process.cwd();
 
@@ -460,9 +439,11 @@ async function restartDaemonFromConfig() {
     debug: lastConfig.debug || false,
     keepAwake: lastConfig.keepAwake || false,
     dangerouslySkipPermissions: lastConfig.dangerouslySkipPermissions || false,
+    osUsers: lastConfig.osUsers || false,
     projects: (lastConfig.projects || []).filter(function (p) {
       return fs.existsSync(p.path);
     }),
+    removedProjects: lastConfig.removedProjects || [],
   };
 
   ensureConfigDir();
@@ -1243,13 +1224,29 @@ function setup(callback) {
   log("");
   log(sym.pointer + "  " + a.bold + "Clay" + a.reset + a.dim + "  ·  Unofficial, open-source project" + a.reset);
   log(sym.bar);
-  log(sym.bar + "  " + a.dim + "Anyone with the URL gets full Claude Code access to this machine." + a.reset);
-  log(sym.bar + "  " + a.dim + "Use a private network (Tailscale, VPN)." + a.reset);
-  log(sym.bar + "  " + a.dim + "The authors assume no responsibility for any damage or data loss." + a.reset);
+  log(sym.bar + "  " + a.yellow + sym.warn + " Disclaimer" + a.reset);
+  log(sym.bar);
+  log(sym.bar + "  " + a.dim + "This is an independent project and is not affiliated with Anthropic." + a.reset);
+  log(sym.bar + "  " + a.dim + "Claude is a trademark of Anthropic." + a.reset);
+  log(sym.bar);
+  log(sym.bar + "  " + a.dim + "Clay is provided \"as is\" without warranty of any kind. Users are" + a.reset);
+  log(sym.bar + "  " + a.dim + "responsible for complying with the terms of service of underlying AI" + a.reset);
+  log(sym.bar + "  " + a.dim + "providers (e.g., Anthropic, OpenAI) and all applicable terms of any" + a.reset);
+  log(sym.bar + "  " + a.dim + "third-party services." + a.reset);
+  log(sym.bar);
+  log(sym.bar + "  " + a.dim + "Features such as multi-user mode are experimental and may involve" + a.reset);
+  log(sym.bar + "  " + a.dim + "sharing access to API-based services. Before enabling such features," + a.reset);
+  log(sym.bar + "  " + a.dim + "review your provider's usage policies regarding account sharing," + a.reset);
+  log(sym.bar + "  " + a.dim + "acceptable use, and any applicable rate limits or restrictions." + a.reset);
+  log(sym.bar);
+  log(sym.bar + "  " + a.dim + "The authors assume no liability for misuse or violations arising" + a.reset);
+  log(sym.bar + "  " + a.dim + "from the use of this software." + a.reset);
+  log(sym.bar);
+  log(sym.bar + "  Type " + a.bold + "agree" + a.reset + " to accept and continue.");
   log(sym.bar);
 
-  promptToggle("Accept and continue", null, true, function (accepted) {
-    if (!accepted) {
+  promptText("", "", function (val) {
+    if (!val || val.trim().toLowerCase() !== "agree") {
       log(sym.end + "  " + a.dim + "Aborted." + a.reset);
       log("");
       process.exit(0);
@@ -1279,44 +1276,99 @@ function setup(callback) {
           }
           port = p;
           log(sym.bar);
+          askMode();
+        });
+      });
+    }
 
-          function askPin() {
-            promptPin(function (pin) {
-              if (dangerouslySkipPermissions && !pin) {
-                log(sym.bar);
-                log(sym.warn + "  " + a.yellow + "WARNING: No PIN + skip permissions = anyone with the URL" + a.reset);
-                log(sym.bar + "  " + a.yellow + "can execute any command without approval." + a.reset);
-                log(sym.bar);
-                promptToggle("Continue without PIN?", null, false, function (confirmed) {
-                  if (!confirmed) {
-                    clearUp(6);
-                    log(sym.done + "  PIN protection " + a.dim + "·" + a.reset + " " + a.yellow + "Required for skip permissions" + a.reset);
-                    log(sym.bar);
-                    askPin();
-                    return;
-                  }
-                  afterPin(pin);
-                });
-              } else {
-                afterPin(pin);
-              }
-            });
-          }
+    function askMode() {
+      promptSelect("How will you use Clay?", [
+        { label: "Just me (single user)", value: "single" },
+        { label: "Multiple users", value: "multi" },
+      ], function (mode) {
+        if (mode === "single") {
+          finishSetup(mode, false);
+        } else {
+          askOsUsers(mode);
+        }
+      });
+    }
 
-          function afterPin(pin) {
-            if (process.platform === "darwin") {
-              promptToggle("Keep awake", "Prevent system sleep while relay is running", false, function (keepAwake) {
-                callback(pin, keepAwake);
-              });
-            } else {
-              callback(pin, false);
-            }
+    function askOsUsers(mode) {
+      // Only offer OS user isolation on Linux
+      if (process.platform !== "linux") {
+        finishSetup(mode, false);
+        return;
+      }
+      log(sym.bar);
+      promptSelect("Enable OS-level user isolation?", [
+        { label: "Yes", value: "yes" },
+        { label: "No", value: "no" },
+      ], function (choice) {
+        if (choice !== "yes") {
+          finishSetup(mode, false);
+          return;
+        }
+        log(sym.bar);
+        log(sym.bar + "  " + a.yellow + sym.warn + " OS-Level User Isolation" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "This feature maps each Clay user to a Linux OS user account." + a.reset);
+        log(sym.bar + "  " + a.dim + "The daemon must run as root and will spawn processes (SDK workers," + a.reset);
+        log(sym.bar + "  " + a.dim + "terminals, file operations) as the mapped Linux user." + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "What this means:" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Each mapped user uses their own ~/.claude/ credentials" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Terminals and file access follow Linux permissions" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Linux user accounts are created automatically (clay-username)" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "Recommended: Run on a dedicated Clay server or cloud instance," + a.reset);
+        log(sym.bar + "  " + a.dim + "not on a personal computer or general-purpose server." + a.reset);
+        log(sym.bar);
+        promptSelect("Confirm", [
+          { label: "Enable OS-level user isolation", value: "confirm" },
+          { label: "Cancel", value: "cancel" },
+        ], function (confirmChoice) {
+          if (confirmChoice !== "confirm") {
+            finishSetup(mode, false);
+            return;
           }
-
-          askPin();
+          var isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+          if (!isRoot) {
+            // Save config so sudo clay can pick it up
+            var partialConfig = {
+              port: port,
+              host: host,
+              mode: "multi",
+              osUsers: true,
+              setupCompleted: true,
+              dangerouslySkipPermissions: dangerouslySkipPermissions,
+            };
+            saveConfig(partialConfig);
+            log(sym.bar);
+            log(sym.warn + "  " + a.yellow + "OS user isolation requires root." + a.reset);
+            log(sym.bar + "  Run:");
+            log(sym.bar + "    " + a.bold + "sudo npx clay-server" + a.reset);
+            log(sym.end);
+            log("");
+            process.exit(0);
+            return;
+          }
+          finishSetup(mode, true);
         });
       });
     }
+
+    function finishSetup(mode, wantOsUsers) {
+      if (process.platform === "darwin") {
+        log(sym.bar);
+        promptToggle("Keep awake", "Prevent system sleep while relay is running", false, function (keepAwake) {
+          callback(mode, keepAwake, wantOsUsers);
+        });
+      } else {
+        callback(mode, false, wantOsUsers);
+      }
+    }
+
     askPort();
   });
 }
@@ -1324,7 +1376,7 @@ function setup(callback) {
 // ==============================
 // Fork the daemon process
 // ==============================
-async function forkDaemon(pin, keepAwake, extraProjects, addCwd) {
+async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
   var ip = getLocalIP();
   var hasTls = false;
 
@@ -1403,11 +1455,14 @@ async function forkDaemon(pin, keepAwake, extraProjects, addCwd) {
     pid: null,
     port: port,
     host: host,
-    pinHash: pin ? generateAuthToken(pin) : null,
+    pinHash: mode === "multi" && cliPin ? generateAuthToken(cliPin) : null,
     tls: hasTls,
     debug: debugMode,
     keepAwake: keepAwake,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
+    osUsers: wantOsUsers || osUsersMode,
+    mode: mode || "single",
+    setupCompleted: true,
     projects: allProjects,
   };
 
@@ -1449,6 +1504,18 @@ async function forkDaemon(pin, keepAwake, extraProjects, addCwd) {
     return;
   }
 
+  // Enable multi-user mode if requested
+  if (config.mode === "multi") {
+    var muResult = enableMultiUser();
+    if (muResult.setupCode) {
+      log("");
+      log(sym.done + "  " + a.green + "Multi-user mode enabled." + a.reset);
+      log(sym.bar + "  Setup code:  " + a.bold + muResult.setupCode + a.reset);
+      log(sym.bar + "  Open Clay in your browser and enter this code to create the admin account.");
+      log("");
+    }
+  }
+
   // Headless mode — print status and exit immediately
   if (headlessMode) {
     var protocol = config.tls ? "https" : "http";
@@ -1467,7 +1534,7 @@ async function forkDaemon(pin, keepAwake, extraProjects, addCwd) {
 // ==============================
 // Dev mode — foreground daemon with file watching
 // ==============================
-async function devMode(pin, keepAwake, existingPinHash) {
+async function devMode(mode, keepAwake, existingPinHash) {
   var ip = getLocalIP();
   var hasTls = false;
 
@@ -1533,11 +1600,13 @@ async function devMode(pin, keepAwake, existingPinHash) {
     pid: null,
     port: port,
     host: host,
-    pinHash: existingPinHash || (pin ? generateAuthToken(pin) : null),
+    pinHash: existingPinHash || null,
     tls: hasTls,
     debug: true,
     keepAwake: keepAwake || false,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
+    mode: mode || "single",
+    setupCompleted: true,
     projects: allProjects,
   };
 
@@ -2268,6 +2337,7 @@ function showSetupGuide(config, ip, goBack) {
 function showSettingsMenu(config, ip) {
   sendIPCCommand(socketPath(), { cmd: "get_status" }).then(function (status) {
     var isAwake = status && status.keepAwake;
+    var isOsUsers = status && status.osUsers;
 
     console.clear();
     printLogo();
@@ -2304,8 +2374,19 @@ function showSettingsMenu(config, ip) {
       ? a.green + "Enabled" + a.reset
       : a.dim + "Off" + a.reset;
 
+    var modeLabel = config.mode === "multi" ? "Multi-user" : "Single user";
+    var modeStatus = config.mode === "multi"
+      ? a.clay + modeLabel + a.reset
+      : a.dim + modeLabel + a.reset;
+    log(sym.bar + "  Mode         " + modeStatus);
     log(sym.bar + "  PIN          " + pinStatus);
     log(sym.bar + "  Multi-user   " + muStatus);
+    var osUsersStatus = isOsUsers
+      ? a.green + "Enabled" + a.reset
+      : a.dim + "Off" + a.reset;
+    if (muEnabled) {
+      log(sym.bar + "  OS users     " + osUsersStatus);
+    }
     if (process.platform === "darwin") {
       log(sym.bar + "  Keep awake   " + awakeStatus);
     }
@@ -2324,6 +2405,11 @@ function showSettingsMenu(config, ip) {
     }
     if (muEnabled) {
       items.push({ label: "Disable multi-user mode", value: "disable_multi_user" });
+      if (isOsUsers) {
+        items.push({ label: "Disable OS-level user isolation", value: "disable_os_users" });
+      } else {
+        items.push({ label: "Enable OS-level user isolation", value: "os_users" });
+      }
     } else {
       items.push({ label: "Enable multi-user mode", value: "multi_user" });
     }
@@ -2331,6 +2417,7 @@ function showSettingsMenu(config, ip) {
       items.push({ label: isAwake ? "Disable keep awake" : "Enable keep awake", value: "awake" });
     }
     items.push({ label: "View logs", value: "logs" });
+    items.push({ label: "Re-run setup wizard", value: "rerun_setup" });
     items.push({ label: "Back", value: "back" });
 
   promptSelect("Select", items, function (choice) {
@@ -2416,6 +2503,182 @@ function showSettingsMenu(config, ip) {
         });
         break;
 
+      case "os_users":
+        if (process.platform === "win32") {
+          log(sym.bar);
+          log(sym.bar + "  " + a.red + "OS-level user isolation is not supported on Windows." + a.reset);
+          log(sym.bar);
+          promptSelect("Back?", [{ label: "Back", value: "back" }], function () {
+            showSettingsMenu(config, ip);
+          });
+          break;
+        }
+        if (process.getuid() !== 0) {
+          log(sym.bar);
+          log(sym.bar + "  " + a.red + "Requires running as root." + a.reset);
+          log(sym.bar);
+          promptSelect("Back?", [{ label: "Back", value: "back" }], function () {
+            showSettingsMenu(config, ip);
+          });
+          break;
+        }
+        if (process.platform !== "linux") {
+          log(sym.bar);
+          log(sym.bar + "  " + a.red + sym.warn + " OS-level user isolation requires Linux." + a.reset);
+          log(sym.bar + "  " + a.dim + "This feature depends on setfacl, getent, and uid/gid process spawning." + a.reset);
+          log(sym.bar + "  " + a.dim + "Use Docker or a Linux VM to run Clay with OS user isolation." + a.reset);
+          log(sym.bar);
+          showSettingsMenu(config, ip);
+          return;
+        }
+        log(sym.bar);
+        log(sym.bar + "  " + a.yellow + sym.warn + " OS-Level User Isolation" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "This feature maps each Clay user to a Linux OS user account." + a.reset);
+        log(sym.bar + "  " + a.dim + "The daemon must run as root and will spawn processes (SDK workers," + a.reset);
+        log(sym.bar + "  " + a.dim + "terminals, file operations) as the mapped Linux user." + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "What this means:" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Each mapped user uses their own ~/.claude/ credentials" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Terminals and file access follow Linux permissions" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Linux user accounts are created automatically (clay-username)" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "Recommended: Run on a dedicated Clay server or cloud instance," + a.reset);
+        log(sym.bar + "  " + a.dim + "not on a personal computer or general-purpose server." + a.reset);
+        log(sym.bar);
+        promptSelect("Select", [
+          { label: "Enable OS-level user isolation", value: "confirm" },
+          { label: "Cancel", value: "cancel" },
+        ], function (confirmChoice) {
+          if (confirmChoice === "confirm") {
+            sendIPCCommand(socketPath(), { cmd: "set_os_users", value: true }).then(function (res) {
+              if (res.ok) {
+                config.osUsers = true;
+                log(sym.bar);
+                log(sym.done + "  " + a.green + "OS-level user isolation enabled." + a.reset);
+                if (res.provisioning) {
+                  var p = res.provisioning;
+                  if (p.provisioned.length > 0) {
+                    log(sym.bar);
+                    log(sym.bar + "  " + a.green + "Provisioned " + p.provisioned.length + " Linux account(s):" + a.reset);
+                    for (var pi = 0; pi < p.provisioned.length; pi++) {
+                      log(sym.bar + "    " + a.dim + p.provisioned[pi].username + " -> " + p.provisioned[pi].linuxUser + a.reset);
+                    }
+                  }
+                  if (p.skipped.length > 0) {
+                    log(sym.bar + "  " + a.dim + p.skipped.length + " user(s) already mapped." + a.reset);
+                  }
+                  if (p.errors.length > 0) {
+                    log(sym.bar);
+                    log(sym.bar + "  " + a.red + p.errors.length + " user(s) failed to provision:" + a.reset);
+                    for (var ei = 0; ei < p.errors.length; ei++) {
+                      log(sym.bar + "    " + a.red + p.errors[ei].username + ": " + p.errors[ei].error + a.reset);
+                    }
+                  }
+                }
+                log(sym.bar + "  " + a.dim + "Restart the daemon for changes to take full effect." + a.reset);
+                log(sym.bar);
+              }
+              showSettingsMenu(config, ip);
+            });
+          } else {
+            showSettingsMenu(config, ip);
+          }
+        });
+        break;
+
+      case "disable_os_users":
+        log(sym.bar);
+        log(sym.bar + "  " + a.yellow + sym.warn + " Disable OS-level user isolation?" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "Processes will no longer be spawned as mapped Linux users." + a.reset);
+        log(sym.bar + "  " + a.dim + "User mappings will be preserved and restored if re-enabled." + a.reset);
+        log(sym.bar);
+        promptSelect("Confirm", [
+          { label: "Disable OS-level user isolation", value: "confirm" },
+          { label: "Cancel", value: "cancel" },
+        ], function (confirmChoice) {
+          if (confirmChoice === "confirm") {
+            sendIPCCommand(socketPath(), { cmd: "set_os_users", value: false }).then(function (res) {
+              if (res.ok) {
+                config.osUsers = false;
+                log(sym.bar);
+                log(sym.done + "  " + a.green + "OS-level user isolation disabled." + a.reset);
+                log(sym.bar + "  " + a.dim + "Restart the daemon for changes to take full effect." + a.reset);
+                log(sym.bar);
+              }
+              showSettingsMenu(config, ip);
+            });
+          } else {
+            showSettingsMenu(config, ip);
+          }
+        });
+        break;
+
+      case "rerun_setup":
+        log(sym.bar);
+        log(sym.bar + "  " + a.yellow + sym.warn + " Re-run setup wizard?" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "This will shut down the running daemon, reset your setup" + a.reset);
+        log(sym.bar + "  " + a.dim + "preferences (mode, port), and walk you through the wizard again." + a.reset);
+        log(sym.bar + "  " + a.dim + "Your projects and user accounts will be preserved." + a.reset);
+        log(sym.bar);
+        promptSelect("Confirm", [
+          { label: "Re-run setup wizard", value: "confirm" },
+          { label: "Cancel", value: "cancel" },
+        ], function (confirmChoice) {
+          if (confirmChoice === "confirm") {
+            // Clear setupCompleted so setup() runs fresh
+            var cfg = loadConfig() || {};
+            delete cfg.setupCompleted;
+            delete cfg.mode;
+            cfg.pid = null;
+            saveConfig(cfg);
+            // Shut down the daemon
+            sendIPCCommand(socketPath(), { cmd: "shutdown" }).then(function () {
+              clearStaleConfig();
+              // Run the setup wizard, then fork a new daemon
+              setup(function (mode, keepAwake, wantOsUsers) {
+                var rc = loadClayrc();
+                var restorable = (rc.recentProjects || []).filter(function (p) {
+                  return p.path !== cwd && fs.existsSync(p.path);
+                });
+                if (restorable.length > 0) {
+                  promptRestoreProjects(restorable, function (selected) {
+                    forkDaemon(mode, keepAwake, selected, false, wantOsUsers);
+                  });
+                } else {
+                  log(sym.bar);
+                  log(sym.end + "  " + a.dim + "Starting relay..." + a.reset);
+                  log("");
+                  forkDaemon(mode, keepAwake, undefined, true, wantOsUsers);
+                }
+              });
+            }).catch(function () {
+              clearStaleConfig();
+              setup(function (mode, keepAwake, wantOsUsers) {
+                var rc = loadClayrc();
+                var restorable = (rc.recentProjects || []).filter(function (p) {
+                  return p.path !== cwd && fs.existsSync(p.path);
+                });
+                if (restorable.length > 0) {
+                  promptRestoreProjects(restorable, function (selected) {
+                    forkDaemon(mode, keepAwake, selected, false, wantOsUsers);
+                  });
+                } else {
+                  log(sym.bar);
+                  log(sym.end + "  " + a.dim + "Starting relay..." + a.reset);
+                  log("");
+                  forkDaemon(mode, keepAwake, undefined, true, wantOsUsers);
+                }
+              });
+            });
+          } else {
+            showSettingsMenu(config, ip);
+          }
+        });
+        break;
+
       case "logs":
         console.clear();
         log(a.bold + "Daemon logs" + a.reset + " " + a.dim + "(" + logPath() + ")" + a.reset);
@@ -2477,14 +2740,14 @@ var currentVersion = require("../package.json").version;
       if (devConfig.pid) clearStaleConfig();
       devConfig = null;
     }
-    // No config — go through setup (disclaimer, port, PIN, etc.)
+    // No config — go through setup (disclaimer, port, mode, etc.)
     if (!devConfig) {
-      setup(function (pin, keepAwake) {
-        devMode(pin, keepAwake, null);
+      setup(function (mode, keepAwake, wantOsUsers) {
+        devMode(mode, keepAwake, null);
       });
     } else {
-      // Reuse existing PIN hash from previous config
-      await devMode(cliPin || null, devConfig.keepAwake || false, devConfig.pinHash || null);
+      // Reuse existing config (repeat run)
+      await devMode(devConfig.mode || "single", devConfig.keepAwake || false, devConfig.pinHash || null);
     }
     return;
   }
@@ -2561,19 +2824,55 @@ var currentVersion = require("../package.json").version;
       showMainMenu(config || { pid: status.pid, port: status.port, tls: status.tls }, ip);
     }
   } else {
-    // No daemon running — first-time setup
-    if (autoYes) {
-      var pin = cliPin || null;
-      console.log("  " + sym.done + "  Auto-accepted disclaimer");
-      console.log("  " + sym.done + "  PIN: " + (pin ? "Enabled" : "Skipped"));
-      if (dangerouslySkipPermissions) {
-        console.log("  " + sym.warn + "  " + a.yellow + "Skip permissions mode enabled" + (pin ? "" : " (no PIN)") + a.reset);
+    // No daemon running — check for saved config (repeat run)
+    var savedConfig = loadConfig();
+    var isRepeatRun = savedConfig && savedConfig.setupCompleted;
+
+    // --multi-user / --os-users CLI flags set config directly for headless/scripted usage
+    if (multiUserMode) {
+      if (!savedConfig) savedConfig = {};
+      savedConfig.mode = "multi";
+      savedConfig.setupCompleted = true;
+    }
+    if (osUsersMode) {
+      if (!savedConfig) savedConfig = {};
+      savedConfig.osUsers = true;
+      savedConfig.mode = "multi";
+      savedConfig.setupCompleted = true;
+    }
+    isRepeatRun = savedConfig && savedConfig.setupCompleted;
+
+    if (isRepeatRun || autoYes) {
+      // Repeat run or --yes: skip wizard, reuse saved config
+      var savedMode = (savedConfig && savedConfig.mode) || "single";
+      var savedKeepAwake = (savedConfig && savedConfig.keepAwake) || false;
+      var savedOsUsers = (savedConfig && savedConfig.osUsers) || false;
+
+      // os-users requires root
+      if (savedOsUsers && typeof process.getuid === "function" && process.getuid() !== 0) {
+        console.error(a.red + "OS user isolation requires root." + a.reset);
+        console.error("Run:  " + a.bold + "sudo npx clay-server" + a.reset);
+        process.exit(1);
+        return;
       }
+
+      if (savedConfig && savedConfig.port) port = savedConfig.port;
+      if (savedConfig && savedConfig.host) host = savedConfig.host;
+      if (savedConfig && savedConfig.dangerouslySkipPermissions) dangerouslySkipPermissions = true;
+
+      if (autoYes) {
+        console.log("  " + sym.done + "  Auto-accepted disclaimer");
+        console.log("  " + sym.done + "  Mode: " + savedMode);
+        if (dangerouslySkipPermissions) {
+          console.log("  " + sym.warn + "  " + a.yellow + "Skip permissions mode enabled" + a.reset);
+        }
+      }
+
       var autoRc = loadClayrc();
       var autoRestorable = (autoRc.recentProjects || []).filter(function (p) {
         return p.path !== cwd && fs.existsSync(p.path);
       });
-      if (autoRestorable.length > 0) {
+      if (autoRestorable.length > 0 && autoYes) {
         console.log("  " + sym.done + "  Restoring " + autoRestorable.length + " previous project(s)");
       }
       // Add cwd if it has history in .clayrc, or if there are no other projects to restore
@@ -2581,9 +2880,10 @@ var currentVersion = require("../package.json").version;
         return p.path === cwd;
       });
       var addCwd = cwdInRc || autoRestorable.length === 0;
-      await forkDaemon(pin, false, autoRestorable.length > 0 ? autoRestorable : undefined, addCwd);
+      await forkDaemon(savedMode, savedKeepAwake, autoRestorable.length > 0 ? autoRestorable : undefined, addCwd, savedOsUsers);
     } else {
-      setup(function (pin, keepAwake) {
+      // First run: interactive wizard
+      setup(function (mode, keepAwake, wantOsUsers) {
         // Check ~/.clayrc for previous projects to restore
         var rc = loadClayrc();
         var restorable = (rc.recentProjects || []).filter(function (p) {
@@ -2592,13 +2892,13 @@ var currentVersion = require("../package.json").version;
 
         if (restorable.length > 0) {
           promptRestoreProjects(restorable, function (selected) {
-            forkDaemon(pin, keepAwake, selected, false);
+            forkDaemon(mode, keepAwake, selected, false, wantOsUsers);
           });
         } else {
           log(sym.bar);
           log(sym.end + "  " + a.dim + "Starting relay..." + a.reset);
           log("");
-          forkDaemon(pin, keepAwake, undefined, true);
+          forkDaemon(mode, keepAwake, undefined, true, wantOsUsers);
         }
       });
     }