clay-server 2.11.0-beta.3 → 2.11.0-beta.5

package/bin/cli.js

@@ -62,6 +62,7 @@ var headlessMode = false;
 var watchMode = false;
 var host = null;
 var multiUserMode = false;
+var osUsersMode = false;
 
 for (var i = 0; i < args.length; i++) {
   if (args[i] === "-p" || args[i] === "--port") {
@@ -108,6 +109,8 @@ for (var i = 0; i < args.length; i++) {
     dangerouslySkipPermissions = true;
   } else if (args[i] === "--multi-user") {
     multiUserMode = true;
+  } else if (args[i] === "--os-users") {
+    osUsersMode = true;
   } else if (args[i] === "-h" || args[i] === "--help") {
     console.log("Usage: clay-server [-p|--port <port>] [--host <address>] [--no-https] [--no-update] [--debug] [-y|--yes] [--pin <pin>] [--shutdown] [--restart]");
     console.log("       clay-server --add <path>     Add a project to the running daemon");
@@ -129,6 +132,7 @@ for (var i = 0; i < args.length; i++) {
     console.log("  --list             List all registered projects");
     console.log("  --headless         Start daemon and exit immediately (implies --yes)");
     console.log("  --multi-user       Enable multi-user mode (generates setup code)");
+    console.log("  --os-users         Enable OS-level user isolation (Linux only, requires root + --multi-user)");
     console.log("  --dangerously-skip-permissions");
     console.log("                     Bypass all permission prompts");
     process.exit(0);
@@ -295,6 +299,30 @@ if (multiUserMode) {
   process.exit(0);
 }
 
+// --- Handle --os-users validation ---
+if (osUsersMode) {
+  if (process.platform !== "linux") {
+    console.error("\x1b[31mError: --os-users requires Linux.\x1b[0m");
+    console.error("OS-level user isolation depends on setfacl, getent, and uid/gid process spawning.");
+    process.exit(1);
+  }
+  if (typeof process.getuid === "function" && process.getuid() !== 0) {
+    console.error("\x1b[31mError: --os-users requires running as root.\x1b[0m");
+    console.error("The daemon must run as root to spawn worker processes as different users.");
+    console.error("Use: sudo clay --multi-user --os-users");
+    process.exit(1);
+  }
+  if (!isMultiUser()) {
+    console.error("\x1b[31mError: --os-users requires --multi-user mode.\x1b[0m");
+    console.error("Enable multi-user mode first: clay --multi-user");
+    process.exit(1);
+  }
+  console.log("\x1b[32mOS-level user isolation enabled.\x1b[0m");
+  console.log("Worker processes will run as mapped Linux users.");
+  console.log("Linux accounts will be auto-provisioned for existing users on startup.");
+  console.log("");
+}
+
 var cwd = process.cwd();
 
 // --- ANSI helpers ---
@@ -460,6 +488,7 @@ async function restartDaemonFromConfig() {
     debug: lastConfig.debug || false,
     keepAwake: lastConfig.keepAwake || false,
     dangerouslySkipPermissions: lastConfig.dangerouslySkipPermissions || false,
+    osUsers: lastConfig.osUsers || false,
     projects: (lastConfig.projects || []).filter(function (p) {
       return fs.existsSync(p.path);
     }),
@@ -1408,6 +1437,7 @@ async function forkDaemon(pin, keepAwake, extraProjects, addCwd) {
     debug: debugMode,
     keepAwake: keepAwake,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
+    osUsers: osUsersMode,
     projects: allProjects,
   };
 
@@ -2268,6 +2298,7 @@ function showSetupGuide(config, ip, goBack) {
 function showSettingsMenu(config, ip) {
   sendIPCCommand(socketPath(), { cmd: "get_status" }).then(function (status) {
     var isAwake = status && status.keepAwake;
+    var isOsUsers = status && status.osUsers;
 
     console.clear();
     printLogo();
@@ -2306,6 +2337,12 @@ function showSettingsMenu(config, ip) {
 
     log(sym.bar + "  PIN          " + pinStatus);
     log(sym.bar + "  Multi-user   " + muStatus);
+    var osUsersStatus = isOsUsers
+      ? a.green + "Enabled" + a.reset
+      : a.dim + "Off" + a.reset;
+    if (muEnabled) {
+      log(sym.bar + "  OS users     " + osUsersStatus);
+    }
     if (process.platform === "darwin") {
       log(sym.bar + "  Keep awake   " + awakeStatus);
     }
@@ -2324,6 +2361,11 @@ function showSettingsMenu(config, ip) {
     }
     if (muEnabled) {
       items.push({ label: "Disable multi-user mode", value: "disable_multi_user" });
+      if (isOsUsers) {
+        items.push({ label: "Disable OS-level user isolation", value: "disable_os_users" });
+      } else {
+        items.push({ label: "Enable OS-level user isolation", value: "os_users" });
+      }
     } else {
       items.push({ label: "Enable multi-user mode", value: "multi_user" });
     }
@@ -2416,6 +2458,118 @@ function showSettingsMenu(config, ip) {
         });
         break;
 
+      case "os_users":
+        if (process.platform === "win32") {
+          log(sym.bar);
+          log(sym.bar + "  " + a.red + "OS-level user isolation is not supported on Windows." + a.reset);
+          log(sym.bar);
+          promptSelect("Back?", [{ label: "Back", value: "back" }], function () {
+            showSettingsMenu(config, ip);
+          });
+          break;
+        }
+        if (process.getuid() !== 0) {
+          log(sym.bar);
+          log(sym.bar + "  " + a.red + "Requires running as root." + a.reset);
+          log(sym.bar);
+          promptSelect("Back?", [{ label: "Back", value: "back" }], function () {
+            showSettingsMenu(config, ip);
+          });
+          break;
+        }
+        if (process.platform !== "linux") {
+          log(sym.bar);
+          log(sym.bar + "  " + a.red + sym.warn + " OS-level user isolation requires Linux." + a.reset);
+          log(sym.bar + "  " + a.dim + "This feature depends on setfacl, getent, and uid/gid process spawning." + a.reset);
+          log(sym.bar + "  " + a.dim + "Use Docker or a Linux VM to run Clay with OS user isolation." + a.reset);
+          log(sym.bar);
+          showSettingsMenu(config, ip);
+          return;
+        }
+        log(sym.bar);
+        log(sym.bar + "  " + a.yellow + sym.warn + " OS-Level User Isolation" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "This feature maps each Clay user to a Linux OS user account." + a.reset);
+        log(sym.bar + "  " + a.dim + "The daemon must run as root and will spawn processes (SDK workers," + a.reset);
+        log(sym.bar + "  " + a.dim + "terminals, file operations) as the mapped Linux user." + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "What this means:" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Each mapped user uses their own ~/.claude/ credentials" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Terminals and file access follow Linux permissions" + a.reset);
+        log(sym.bar + "  " + a.dim + "- Linux user accounts are created automatically (clay-username)" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "Recommended: Run on a dedicated Clay server or cloud instance," + a.reset);
+        log(sym.bar + "  " + a.dim + "not on a personal computer or general-purpose server." + a.reset);
+        log(sym.bar);
+        promptSelect("Select", [
+          { label: "Enable OS-level user isolation", value: "confirm" },
+          { label: "Cancel", value: "cancel" },
+        ], function (confirmChoice) {
+          if (confirmChoice === "confirm") {
+            sendIPCCommand(socketPath(), { cmd: "set_os_users", value: true }).then(function (res) {
+              if (res.ok) {
+                config.osUsers = true;
+                log(sym.bar);
+                log(sym.done + "  " + a.green + "OS-level user isolation enabled." + a.reset);
+                if (res.provisioning) {
+                  var p = res.provisioning;
+                  if (p.provisioned.length > 0) {
+                    log(sym.bar);
+                    log(sym.bar + "  " + a.green + "Provisioned " + p.provisioned.length + " Linux account(s):" + a.reset);
+                    for (var pi = 0; pi < p.provisioned.length; pi++) {
+                      log(sym.bar + "    " + a.dim + p.provisioned[pi].username + " -> " + p.provisioned[pi].linuxUser + a.reset);
+                    }
+                  }
+                  if (p.skipped.length > 0) {
+                    log(sym.bar + "  " + a.dim + p.skipped.length + " user(s) already mapped." + a.reset);
+                  }
+                  if (p.errors.length > 0) {
+                    log(sym.bar);
+                    log(sym.bar + "  " + a.red + p.errors.length + " user(s) failed to provision:" + a.reset);
+                    for (var ei = 0; ei < p.errors.length; ei++) {
+                      log(sym.bar + "    " + a.red + p.errors[ei].username + ": " + p.errors[ei].error + a.reset);
+                    }
+                  }
+                }
+                log(sym.bar + "  " + a.dim + "Restart the daemon for changes to take full effect." + a.reset);
+                log(sym.bar);
+              }
+              showSettingsMenu(config, ip);
+            });
+          } else {
+            showSettingsMenu(config, ip);
+          }
+        });
+        break;
+
+      case "disable_os_users":
+        log(sym.bar);
+        log(sym.bar + "  " + a.yellow + sym.warn + " Disable OS-level user isolation?" + a.reset);
+        log(sym.bar);
+        log(sym.bar + "  " + a.dim + "Processes will no longer be spawned as mapped Linux users." + a.reset);
+        log(sym.bar + "  " + a.dim + "User mappings will be preserved and restored if re-enabled." + a.reset);
+        log(sym.bar);
+        promptSelect("Confirm", [
+          { label: "Disable OS-level user isolation", value: "confirm" },
+          { label: "Cancel", value: "cancel" },
+        ], function (confirmChoice) {
+          if (confirmChoice === "confirm") {
+            sendIPCCommand(socketPath(), { cmd: "set_os_users", value: false }).then(function (res) {
+              if (res.ok) {
+                config.osUsers = false;
+                log(sym.bar);
+                log(sym.done + "  " + a.green + "OS-level user isolation disabled." + a.reset);
+                log(sym.bar + "  " + a.dim + "Restart the daemon for changes to take full effect." + a.reset);
+                log(sym.bar);
+              }
+              showSettingsMenu(config, ip);
+            });
+          } else {
+            showSettingsMenu(config, ip);
+          }
+        });
+        break;
+
       case "logs":
         console.clear();
         log(a.bold + "Daemon logs" + a.reset + " " + a.dim + "(" + logPath() + ")" + a.reset);

package/lib/daemon.js

@@ -25,6 +25,8 @@ var path = require("path");
 var { loadConfig, saveConfig, socketPath, generateSlug, syncClayrc, removeFromClayrc, writeCrashInfo, readCrashInfo, clearCrashInfo, isPidAlive, clearStaleConfig } = require("./config");
 var { createIPCServer } = require("./ipc");
 var { createServer, generateAuthToken } = require("./server");
+var { grantProjectAccess, revokeProjectAccess, provisionAllUsers, provisionLinuxUser, grantAllUsersAccess, deactivateLinuxUser, ensureProjectsDir } = require("./os-users");
+var usersModule = require("./users");
 
 var configFile = process.env.CLAY_CONFIG || process.env.CLAUDE_RELAY_CONFIG || require("./config").configPath();
 var config;
@@ -90,6 +92,7 @@ var relay = createServer({
   port: config.port,
   debug: config.debug || false,
   dangerouslySkipPermissions: config.dangerouslySkipPermissions || false,
+  osUsers: config.osUsers || false,
   lanHost: lanIp ? lanIp + ":" + config.port : null,
   onAddProject: function (absPath) {
     // Check if already registered
@@ -105,6 +108,16 @@ var relay = createServer({
     saveConfig(config);
     try { syncClayrc(config.projects); } catch (e) {}
     console.log("[daemon] Added project (web):", slug, "→", absPath);
+    // OS users mode: grant ACL to project owner
+    if (config.osUsers) {
+      var newProj = config.projects[config.projects.length - 1];
+      if (newProj.ownerId) {
+        var ownerUser = usersModule.findUserById(newProj.ownerId);
+        if (ownerUser && ownerUser.linuxUser) {
+          grantProjectAccess(absPath, ownerUser.linuxUser);
+        }
+      }
+    }
     // Broadcast updated project list to all clients
     relay.broadcastAll({
       type: "projects_updated",
@@ -113,6 +126,137 @@ var relay = createServer({
     });
     return { ok: true, slug: slug };
   },
+  onCreateProject: function (projectName, wsUser) {
+    var os = require("os");
+    var { execSync } = require("child_process");
+    var baseDir;
+    if (config.osUsers) {
+      baseDir = "/var/clay/projects";
+    } else {
+      baseDir = config.projectsDir || path.join(os.homedir(), "clay-projects");
+    }
+    try { fs.mkdirSync(baseDir, { recursive: true }); } catch (e) {}
+    // Generate slug and deduplicate
+    var slugs = config.projects.map(function (p) { return p.slug; });
+    var slug = generateSlug(path.join(baseDir, projectName), slugs);
+    var targetDir = path.join(baseDir, slug);
+    try {
+      fs.mkdirSync(targetDir, { recursive: true });
+      // Run git init
+      if (config.osUsers && wsUser) {
+        var linuxUser = wsUser.linuxUser;
+        if (linuxUser) {
+          var uidGid = null;
+          try {
+            var passwdLine = execSync("id -u " + linuxUser + " && id -g " + linuxUser, { encoding: "utf8" }).trim().split("\n");
+            uidGid = { uid: parseInt(passwdLine[0], 10), gid: parseInt(passwdLine[1], 10) };
+          } catch (e) {}
+          if (uidGid) {
+            execSync("git init", { cwd: targetDir, uid: uidGid.uid, gid: uidGid.gid });
+            execSync("chown -R " + linuxUser + ":" + linuxUser + " " + JSON.stringify(targetDir));
+          } else {
+            execSync("git init", { cwd: targetDir });
+          }
+        } else {
+          execSync("git init", { cwd: targetDir });
+        }
+      } else {
+        execSync("git init", { cwd: targetDir });
+      }
+    } catch (e) {
+      try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
+      return { ok: false, error: "Failed to create project: " + e.message };
+    }
+    // Register project
+    var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now() };
+    if (config.osUsers && wsUser) {
+      projectEntry.ownerId = wsUser.id;
+    }
+    relay.addProject(targetDir, slug);
+    config.projects.push(projectEntry);
+    saveConfig(config);
+    try { syncClayrc(config.projects); } catch (e) {}
+    console.log("[daemon] Created project:", slug, "→", targetDir);
+    // OS users mode: grant ACL
+    if (config.osUsers && wsUser && wsUser.linuxUser) {
+      grantProjectAccess(targetDir, wsUser.linuxUser);
+    }
+    relay.broadcastAll({
+      type: "projects_updated",
+      projects: relay.getProjects(),
+      projectCount: config.projects.length,
+    });
+    return { ok: true, slug: slug };
+  },
+  onCloneProject: function (cloneUrl, wsUser, callback) {
+    var os = require("os");
+    var { spawn, execSync } = require("child_process");
+    var baseDir;
+    if (config.osUsers) {
+      baseDir = "/var/clay/projects";
+    } else {
+      baseDir = config.projectsDir || path.join(os.homedir(), "clay-projects");
+    }
+    try { fs.mkdirSync(baseDir, { recursive: true }); } catch (e) {}
+    // Derive slug from repo URL
+    var repoName = cloneUrl.replace(/\.git$/, "").split("/").pop() || "project";
+    var slugs = config.projects.map(function (p) { return p.slug; });
+    var slug = generateSlug(path.join(baseDir, repoName), slugs);
+    var targetDir = path.join(baseDir, slug);
+    // Build spawn options
+    var spawnOpts = { cwd: baseDir };
+    if (config.osUsers && wsUser && wsUser.linuxUser) {
+      try {
+        var passwdLine = execSync("id -u " + wsUser.linuxUser + " && id -g " + wsUser.linuxUser, { encoding: "utf8" }).trim().split("\n");
+        spawnOpts.uid = parseInt(passwdLine[0], 10);
+        spawnOpts.gid = parseInt(passwdLine[1], 10);
+      } catch (e) {}
+    }
+    var proc = spawn("git", ["clone", cloneUrl, targetDir], spawnOpts);
+    var stderrBuf = "";
+    proc.stderr.on("data", function (chunk) { stderrBuf += chunk.toString(); });
+    // 5 minute timeout
+    var cloneTimeout = setTimeout(function () {
+      proc.kill("SIGTERM");
+    }, 5 * 60 * 1000);
+    proc.on("close", function (code) {
+      clearTimeout(cloneTimeout);
+      if (code !== 0) {
+        try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
+        var errMsg = stderrBuf.trim().split("\n").pop() || "Clone failed (exit code " + code + ")";
+        callback({ ok: false, error: errMsg });
+        return;
+      }
+      // chown if osUsers
+      if (config.osUsers && wsUser && wsUser.linuxUser) {
+        try { execSync("chown -R " + wsUser.linuxUser + ":" + wsUser.linuxUser + " " + JSON.stringify(targetDir)); } catch (e) {}
+      }
+      // Register project
+      var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now() };
+      if (config.osUsers && wsUser) {
+        projectEntry.ownerId = wsUser.id;
+      }
+      relay.addProject(targetDir, slug);
+      config.projects.push(projectEntry);
+      saveConfig(config);
+      try { syncClayrc(config.projects); } catch (e) {}
+      console.log("[daemon] Cloned project:", slug, "→", targetDir);
+      if (config.osUsers && wsUser && wsUser.linuxUser) {
+        grantProjectAccess(targetDir, wsUser.linuxUser);
+      }
+      relay.broadcastAll({
+        type: "projects_updated",
+        projects: relay.getProjects(),
+        projectCount: config.projects.length,
+      });
+      callback({ ok: true, slug: slug });
+    });
+    proc.on("error", function (err) {
+      clearTimeout(cloneTimeout);
+      try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
+      callback({ ok: false, error: "Failed to start git clone: " + err.message });
+    });
+  },
   onRemoveProject: function (slug) {
     var found = false;
     for (var j = 0; j < config.projects.length; j++) {
@@ -211,6 +355,49 @@ var relay = createServer({
     });
     return { ok: true };
   },
+  onProjectOwnerChanged: function (slug, ownerId) {
+    var oldOwnerId = null;
+    var projectIdx = -1;
+    for (var oi = 0; oi < config.projects.length; oi++) {
+      if (config.projects[oi].slug === slug) {
+        oldOwnerId = config.projects[oi].ownerId || null;
+        projectIdx = oi;
+        if (ownerId) {
+          config.projects[oi].ownerId = ownerId;
+        } else {
+          delete config.projects[oi].ownerId;
+        }
+        break;
+      }
+    }
+    saveConfig(config);
+    // OS users mode: revoke old owner ACL, grant new owner ACL
+    if (config.osUsers && projectIdx >= 0) {
+      var projectPath = config.projects[projectIdx].path;
+      var allowed = config.projects[projectIdx].allowedUsers || [];
+      var visibility = config.projects[projectIdx].visibility || "public";
+      // Revoke old owner (if not in allowedUsers and project is not public)
+      if (oldOwnerId && oldOwnerId !== ownerId) {
+        var oldOwner = usersModule.findUserById(oldOwnerId);
+        if (oldOwner && oldOwner.linuxUser && allowed.indexOf(oldOwnerId) === -1 && visibility !== "public") {
+          revokeProjectAccess(projectPath, oldOwner.linuxUser);
+        }
+      }
+      // Grant new owner
+      if (ownerId) {
+        var newOwner = usersModule.findUserById(ownerId);
+        if (newOwner && newOwner.linuxUser) {
+          grantProjectAccess(projectPath, newOwner.linuxUser);
+        }
+      }
+    }
+    relay.broadcastAll({
+      type: "projects_updated",
+      projects: relay.getProjects(),
+      projectCount: config.projects.length,
+    });
+    return { ok: true };
+  },
   onGetProjectEnv: function (slug) {
     for (var ei = 0; ei < config.projects.length; ei++) {
       if (config.projects[ei].slug === slug) {
@@ -355,8 +542,17 @@ var relay = createServer({
       keepAwake: !!config.keepAwake,
       pinEnabled: !!config.pinHash,
       platform: process.platform,
+      hostname: os2.hostname(),
+      lanIp: lanIp || null,
+      updateChannel: config.updateChannel || "stable",
     };
   },
+  onSetUpdateChannel: function (channel) {
+    config.updateChannel = channel === "beta" ? "beta" : "stable";
+    saveConfig(config);
+    console.log("[daemon] Update channel:", config.updateChannel, "(web)");
+    return { ok: true, updateChannel: config.updateChannel };
+  },
   onSetPin: function (pin) {
     if (pin) {
       config.pinHash = generateAuthToken(pin);
@@ -402,9 +598,31 @@ var relay = createServer({
   onSetProjectVisibility: function (slug, visibility) {
     for (var i = 0; i < config.projects.length; i++) {
       if (config.projects[i].slug === slug) {
+        var prevVisibility = config.projects[i].visibility || "public";
         config.projects[i].visibility = visibility;
         saveConfig(config);
         console.log("[daemon] Set project visibility:", slug, "→", visibility);
+        if (config.osUsers) {
+          var projectPath = config.projects[i].path;
+          var ownerId = config.projects[i].ownerId || null;
+          // When switching to public: grant ACL to ALL clay users
+          if (visibility === "public" && prevVisibility !== "public") {
+            grantAllUsersAccess(projectPath, usersModule);
+          }
+          // When switching to private: revoke ACLs for users not in allowedUsers and not the owner
+          if (visibility === "private" && prevVisibility !== "private") {
+            var allowed = config.projects[i].allowedUsers || [];
+            var allUsers = usersModule.getAllUsers();
+            for (var u = 0; u < allUsers.length; u++) {
+              var usr = allUsers[u];
+              if (usr.role === "admin") continue;
+              if (usr.id === ownerId) continue;
+              if (usr.linuxUser && allowed.indexOf(usr.id) === -1) {
+                revokeProjectAccess(projectPath, usr.linuxUser);
+              }
+            }
+          }
+        }
         return { ok: true };
       }
     }
@@ -413,9 +631,32 @@ var relay = createServer({
   onSetProjectAllowedUsers: function (slug, allowedUsers) {
     for (var i = 0; i < config.projects.length; i++) {
       if (config.projects[i].slug === slug) {
+        var prev = config.projects[i].allowedUsers || [];
         config.projects[i].allowedUsers = allowedUsers;
         saveConfig(config);
         console.log("[daemon] Set project allowed users:", slug, "→", allowedUsers.length, "users");
+        // OS users mode: sync ACLs for added/removed users
+        if (config.osUsers) {
+          var projectPath = config.projects[i].path;
+          // Grant access to newly added users
+          for (var a = 0; a < allowedUsers.length; a++) {
+            if (prev.indexOf(allowedUsers[a]) === -1) {
+              var addedUser = usersModule.findUserById(allowedUsers[a]);
+              if (addedUser && addedUser.linuxUser) {
+                grantProjectAccess(projectPath, addedUser.linuxUser);
+              }
+            }
+          }
+          // Revoke access from removed users
+          for (var r = 0; r < prev.length; r++) {
+            if (allowedUsers.indexOf(prev[r]) === -1) {
+              var removedUser = usersModule.findUserById(prev[r]);
+              if (removedUser && removedUser.linuxUser) {
+                revokeProjectAccess(projectPath, removedUser.linuxUser);
+              }
+            }
+          }
+        }
         return { ok: true };
       }
     }
@@ -433,6 +674,22 @@ var relay = createServer({
     }
     return { error: "Project not found" };
   },
+  onUserProvisioned: function (userId, linuxUser) {
+    // Grant ACL on all public projects to the newly provisioned user
+    if (!config.osUsers || !linuxUser) return;
+    for (var i = 0; i < config.projects.length; i++) {
+      var proj = config.projects[i];
+      var visibility = proj.visibility || "public";
+      if (visibility === "public") {
+        grantProjectAccess(proj.path, linuxUser);
+      }
+    }
+  },
+  onUserDeleted: function (userId, linuxUser) {
+    // Deactivate the Linux account when a Clay user is deleted
+    if (!config.osUsers || !linuxUser) return;
+    deactivateLinuxUser(linuxUser);
+  },
 });
 
 // --- Register projects ---
@@ -441,7 +698,7 @@ for (var i = 0; i < projects.length; i++) {
   var p = projects[i];
   if (fs.existsSync(p.path)) {
     console.log("[daemon] Adding project:", p.slug, "→", p.path);
-    relay.addProject(p.path, p.slug, p.title, p.icon);
+    relay.addProject(p.path, p.slug, p.title, p.icon, p.ownerId);
   } else {
     console.log("[daemon] Skipping missing project:", p.path);
   }
@@ -518,6 +775,7 @@ var ipc = createIPCServer(socketPath(), function (msg) {
         port: config.port,
         tls: !!tlsOptions,
         keepAwake: !!config.keepAwake,
+        osUsers: !!config.osUsers,
         projects: relay.getProjects(),
         uptime: process.uptime(),
       };
@@ -554,6 +812,53 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       return { ok: true };
     }
 
+    case "set_os_users": {
+      var enableOsUsers = !!msg.value;
+      config.osUsers = enableOsUsers;
+      saveConfig(config);
+      console.log("[daemon] OS users:", enableOsUsers);
+      if (enableOsUsers) {
+        // Ensure shared projects directory exists
+        try { ensureProjectsDir(); } catch (e) {
+          console.error("[daemon] Failed to create projects dir:", e.message);
+        }
+        // Auto-provision Linux accounts for all existing users
+        var provisionResult = provisionAllUsers(usersModule);
+        console.log("[daemon] Provisioning result: " +
+          provisionResult.provisioned.length + " provisioned, " +
+          provisionResult.skipped.length + " skipped, " +
+          provisionResult.errors.length + " errors");
+        // Set up ACLs for all existing projects
+        for (var pi = 0; pi < config.projects.length; pi++) {
+          var proj = config.projects[pi];
+          var projPath = proj.path;
+          var projVisibility = proj.visibility || "public";
+          // Grant ACL to project owner
+          if (proj.ownerId) {
+            var ownerUser = usersModule.findUserById(proj.ownerId);
+            if (ownerUser && ownerUser.linuxUser) {
+              grantProjectAccess(projPath, ownerUser.linuxUser);
+            }
+          }
+          // Public projects: grant ACL to all users
+          if (projVisibility === "public") {
+            grantAllUsersAccess(projPath, usersModule);
+          } else {
+            // Private projects: grant ACL to allowedUsers
+            var projAllowed = proj.allowedUsers || [];
+            for (var ai = 0; ai < projAllowed.length; ai++) {
+              var allowedUser = usersModule.findUserById(projAllowed[ai]);
+              if (allowedUser && allowedUser.linuxUser) {
+                grantProjectAccess(projPath, allowedUser.linuxUser);
+              }
+            }
+          }
+        }
+        return { ok: true, provisioning: provisionResult };
+      }
+      return { ok: true };
+    }
+
     case "set_keep_awake": {
       var want = !!msg.value;
       config.keepAwake = want;
@@ -595,11 +900,12 @@ var ipc = createIPCServer(socketPath(), function (msg) {
 
       // Production: fetch latest via npx, then spawn updated daemon
       var { execSync: execSyncUpd, spawn: spawnUpd } = require("child_process");
+      var updTag = config.updateChannel === "beta" ? "beta" : "latest";
       var updDaemonScript;
       try {
         // npx downloads the package and puts a bin symlink; `which` prints its path
         var binPath = execSyncUpd(
-          "npx --yes --package=clay-server@latest -- which clay-server",
+          "npx --yes --package=clay-server@" + updTag + " -- which clay-server",
           { stdio: ["ignore", "pipe", "pipe"], timeout: 120000, encoding: "utf8" }
         ).trim();
         // Resolve symlink to get the actual package directory
@@ -653,6 +959,39 @@ function startListening() {
     config.pid = process.pid;
     saveConfig(config);
 
+    // Auto-provision Linux accounts on startup if OS users mode is enabled
+    if (config.osUsers) {
+      try { ensureProjectsDir(); } catch (e) {}
+      var provResult = provisionAllUsers(usersModule);
+      if (provResult.provisioned.length > 0) {
+        console.log("[daemon] Auto-provisioned " + provResult.provisioned.length + " Linux account(s) on startup");
+      }
+      if (provResult.errors.length > 0) {
+        console.error("[daemon] Failed to provision " + provResult.errors.length + " account(s)");
+      }
+      // Set up ACLs for all existing projects on startup
+      for (var pi = 0; pi < config.projects.length; pi++) {
+        var proj = config.projects[pi];
+        if (proj.ownerId) {
+          var ownerUser = usersModule.findUserById(proj.ownerId);
+          if (ownerUser && ownerUser.linuxUser) {
+            grantProjectAccess(proj.path, ownerUser.linuxUser);
+          }
+        }
+        if ((proj.visibility || "public") === "public") {
+          grantAllUsersAccess(proj.path, usersModule);
+        } else {
+          var projAllowed = proj.allowedUsers || [];
+          for (var ai = 0; ai < projAllowed.length; ai++) {
+            var allowedUser = usersModule.findUserById(projAllowed[ai]);
+            if (allowedUser && allowedUser.linuxUser) {
+              grantProjectAccess(proj.path, allowedUser.linuxUser);
+            }
+          }
+        }
+      }
+    }
+
     // Check for crash info from a previous crash and notify clients
     var crashInfo = readCrashInfo();
     if (crashInfo) {