clay-server 2.20.0 → 2.20.1-beta.10

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center"><img src="media/hero.png" alt="Clay workspace" /></p>
 
-AI teammates who remember your decisions, challenge your thinking, and grow with your codebase. Runs on your machine.
+A team workspace built on Claude Code. AI teammates who remember your decisions, challenge your thinking, and grow with your codebase. Runs on your machine.
 
 ```bash
 npx clay-server

package/bin/cli.js

@@ -36,7 +36,7 @@ var crypto = require("crypto");
 var { loadConfig, saveConfig, configPath, socketPath, logPath, ensureConfigDir, isDaemonAlive, isDaemonAliveAsync, generateSlug, clearStaleConfig, loadClayrc, saveClayrc, readCrashInfo, REAL_HOME } = require("../lib/config");
 var { sendIPCCommand } = require("../lib/ipc");
 var { generateAuthToken } = require("../lib/server");
-var { enableMultiUser, disableMultiUser, hasAdmin, isMultiUser } = require("../lib/users");
+var { enableMultiUser, disableMultiUser, hasAdmin, isMultiUser, getSetupCode } = require("../lib/users");
 
 function openUrl(url) {
   try {
@@ -1417,16 +1417,15 @@ function setup(callback) {
           }
           var isRoot = typeof process.getuid === "function" && process.getuid() === 0;
           if (!isRoot) {
-            // Save config so sudo clay can pick it up
-            var partialConfig = {
-              port: port,
-              host: host,
-              mode: "multi",
-              osUsers: true,
-              setupCompleted: true,
-              dangerouslySkipPermissions: dangerouslySkipPermissions,
-            };
-            saveConfig(partialConfig);
+            // Merge into existing config (preserve projects, TLS, etc.)
+            var existingCfg = loadConfig() || {};
+            existingCfg.port = port;
+            existingCfg.host = host;
+            existingCfg.mode = "multi";
+            existingCfg.osUsers = true;
+            existingCfg.setupCompleted = true;
+            if (dangerouslySkipPermissions) existingCfg.dangerouslySkipPermissions = true;
+            saveConfig(existingCfg);
             log(sym.bar);
             log(sym.warn + "  " + a.yellow + "OS user isolation requires root." + a.reset);
             log(sym.bar + "  Run:");
@@ -1999,6 +1998,7 @@ function showMainMenu(config, ip, setupCode) {
         parts.push(a.reset + a.yellow + a.bold + totalAwaiting + a.reset + a.yellow + " awaiting" + a.reset + a.dim);
       }
       log("  " + a.dim + parts.join(a.reset + a.dim + " · ") + a.reset);
+      log("  " + a.dim + "~/.clay → " + path.join(REAL_HOME, ".clay") + a.reset);
       log("  Press " + a.bold + "o" + a.reset + " to open in browser");
       log("");
 
@@ -2009,8 +2009,10 @@ function showMainMenu(config, ip, setupCode) {
         log("");
       }
 
-      if (setupCode) {
-        log("  " + a.yellow + sym.warn + " Setup code:  " + a.bold + setupCode + a.reset);
+      // Always show setup code if one exists (persists until admin is created)
+      var displayCode = setupCode || getSetupCode();
+      if (displayCode) {
+        log("  " + a.yellow + sym.warn + " Setup code:  " + a.bold + displayCode + a.reset);
         log("  " + a.dim + "Open Clay in your browser and enter this code to create the admin account." + a.reset);
         log("");
       }
@@ -2373,6 +2375,9 @@ function showSettingsMenu(config, ip) {
     } else {
       items.push({ label: "Enable multi-user mode", value: "multi_user" });
     }
+    if (muEnabled) {
+      items.push({ label: "Show setup code", value: "show_setup_code" });
+    }
     if (muEnabled && hasAdmin()) {
       items.push({ label: "Recover admin password", value: "recover_admin" });
     }
@@ -2478,7 +2483,9 @@ function showSettingsMenu(config, ip) {
         }
         if (process.getuid() !== 0) {
           log(sym.bar);
-          log(sym.bar + "  " + a.red + "Requires running as root." + a.reset);
+          log(sym.bar + "  " + a.red + sym.warn + " OS user isolation requires root." + a.reset);
+          log(sym.bar + "  " + a.dim + "Shut down this server, then restart with:" + a.reset);
+          log(sym.bar + "    " + a.bold + "sudo npx clay-server" + a.reset);
           log(sym.bar);
           promptSelect("Back?", [{ label: "Back", value: "back" }], function () {
             showSettingsMenu(config, ip);
@@ -2527,33 +2534,95 @@ function showSettingsMenu(config, ip) {
                 log(sym.bar);
                 log(sym.bar + "  " + a.dim + "Then try enabling OS user isolation again." + a.reset);
                 log(sym.bar);
-              } else if (res.ok) {
-                config.osUsers = true;
+                showSettingsMenu(config, ip);
+                return;
+              } else if (res.error) {
                 log(sym.bar);
-                log(sym.done + "  " + a.green + "OS-level user isolation enabled." + a.reset);
-                if (res.provisioning) {
-                  var p = res.provisioning;
-                  if (p.provisioned.length > 0) {
-                    log(sym.bar);
-                    log(sym.bar + "  " + a.green + "Provisioned " + p.provisioned.length + " Linux account(s):" + a.reset);
-                    for (var pi = 0; pi < p.provisioned.length; pi++) {
-                      log(sym.bar + "    " + a.dim + p.provisioned[pi].username + " -> " + p.provisioned[pi].linuxUser + a.reset);
-                    }
+                log(sym.bar + "  " + a.red + sym.warn + " Failed to enable OS users: " + res.error + a.reset);
+                log(sym.bar);
+                showSettingsMenu(config, ip);
+                return;
+              } else if (!res.ok) {
+                log(sym.bar);
+                log(sym.bar + "  " + a.red + sym.warn + " Unexpected response from daemon." + a.reset);
+                log(sym.bar + "  " + a.dim + JSON.stringify(res) + a.reset);
+                log(sym.bar);
+                showSettingsMenu(config, ip);
+                return;
+              }
+              // Daemon saved the flag. Now provision from CLI with live progress.
+              config.osUsers = true;
+              log(sym.bar);
+              log(sym.done + "  " + a.green + "OS-level user isolation enabled." + a.reset);
+              log(sym.bar);
+
+              // Provision Linux accounts from CLI (we have root + terminal)
+              var osUsersLib = require("../lib/os-users");
+              var usersLib = require("../lib/users");
+
+              try { osUsersLib.ensureProjectsDir(); } catch (e) {
+                log(sym.bar + "  " + a.yellow + sym.warn + " Failed to create projects dir: " + e.message + a.reset);
+              }
+
+              var allUsers = usersLib.getAllUsers();
+              if (allUsers.length === 0) {
+                log(sym.bar + "  " + a.dim + "No users to provision yet. Accounts will be created when users register." + a.reset);
+              } else {
+                log(sym.bar + "  " + a.dim + "Provisioning " + allUsers.length + " user(s)..." + a.reset);
+                for (var ui = 0; ui < allUsers.length; ui++) {
+                  var usr = allUsers[ui];
+                  if (usr.linuxUser && osUsersLib.linuxUserExists(usr.linuxUser)) {
+                    log(sym.bar + "    " + a.dim + sym.done + " " + usr.username + " -> " + usr.linuxUser + " (exists)" + a.reset);
+                    continue;
                   }
-                  if (p.skipped.length > 0) {
-                    log(sym.bar + "  " + a.dim + p.skipped.length + " user(s) already mapped." + a.reset);
+                  log(sym.bar + "    " + a.dim + "Creating Linux account for " + usr.username + "..." + a.reset);
+                  var provision = osUsersLib.provisionLinuxUser(usr.username);
+                  if (provision.ok) {
+                    usersLib.updateLinuxUser(usr.id, provision.linuxUser);
+                    log(sym.bar + "    " + a.green + sym.done + " " + usr.username + " -> " + provision.linuxUser + a.reset);
+                  } else {
+                    log(sym.bar + "    " + a.red + sym.warn + " " + usr.username + ": " + (provision.error || "unknown error") + a.reset);
                   }
-                  if (p.errors.length > 0) {
-                    log(sym.bar);
-                    log(sym.bar + "  " + a.red + p.errors.length + " user(s) failed to provision:" + a.reset);
-                    for (var ei = 0; ei < p.errors.length; ei++) {
-                      log(sym.bar + "    " + a.red + p.errors[ei].username + ": " + p.errors[ei].error + a.reset);
+                }
+              }
+
+              // Set up ACLs for existing projects
+              var cfg = loadConfig() || {};
+              var cfgProjects = cfg.projects || [];
+              if (cfgProjects.length > 0) {
+                log(sym.bar);
+                log(sym.bar + "  " + a.dim + "Setting ACLs for " + cfgProjects.length + " project(s)..." + a.reset);
+                for (var pi = 0; pi < cfgProjects.length; pi++) {
+                  var proj = cfgProjects[pi];
+                  if (osUsersLib.isHomeDirectory(proj.path)) {
+                    log(sym.bar + "    " + a.dim + "~ " + (proj.slug || proj.path) + " (home dir, skipped)" + a.reset);
+                    continue;
+                  }
+                  try {
+                    if (proj.visibility === "public") {
+                      osUsersLib.grantAllUsersAccess(proj.path, usersLib);
+                    }
+                    if (proj.ownerId) {
+                      var ownerUser = usersLib.findUserById(proj.ownerId);
+                      if (ownerUser && ownerUser.linuxUser) {
+                        osUsersLib.grantProjectAccess(proj.path, ownerUser.linuxUser);
+                      }
                     }
+                    log(sym.bar + "    " + a.dim + sym.done + " " + (proj.slug || proj.path) + a.reset);
+                  } catch (aclErr) {
+                    log(sym.bar + "    " + a.yellow + sym.warn + " " + (proj.slug || proj.path) + ": " + aclErr.message + a.reset);
                   }
                 }
-                log(sym.bar + "  " + a.dim + "Restart the daemon for changes to take full effect." + a.reset);
-                log(sym.bar);
               }
+
+              log(sym.bar);
+              log(sym.bar + "  " + a.dim + "Restart the daemon for full effect." + a.reset);
+              log(sym.bar);
+              showSettingsMenu(config, ip);
+            }).catch(function (err) {
+              log(sym.bar);
+              log(sym.bar + "  " + a.red + sym.warn + " IPC error: " + (err.message || err) + a.reset);
+              log(sym.bar);
               showSettingsMenu(config, ip);
             });
           } else {
@@ -2603,33 +2672,48 @@ function showSettingsMenu(config, ip) {
           { label: "Cancel", value: "cancel" },
         ], function (confirmChoice) {
           if (confirmChoice === "confirm") {
-            // Clear setupCompleted so setup() runs fresh
+            // Save old PID before clearing, so we can force-kill if needed
             var cfg = loadConfig() || {};
+            var oldPid = cfg.pid;
+            // Clear setupCompleted so setup() runs fresh
             delete cfg.setupCompleted;
             delete cfg.mode;
             cfg.pid = null;
             saveConfig(cfg);
-            // Shut down the daemon
-            sendIPCCommand(socketPath(), { cmd: "shutdown" }).then(function () {
-              clearStaleConfig();
-              // Run the setup wizard, then fork a new daemon
-              setup(function (mode, keepAwake, wantOsUsers) {
-                var rc = loadClayrc();
-                var restorable = (rc.recentProjects || []).filter(function (p) {
-                  return p.path !== cwd && fs.existsSync(p.path);
+
+            // Helper: wait for port to be free, force-kill if needed
+            function waitForPortFree(cb) {
+              var attempts = 0;
+              var maxAttempts = 12; // 6 seconds total
+              function check() {
+                isPortFree(port).then(function (free) {
+                  if (free) return cb();
+                  attempts++;
+                  if (attempts >= maxAttempts) {
+                    // Port still busy, force-kill old daemon
+                    if (oldPid) {
+                      try { process.kill(oldPid, "SIGKILL"); } catch (e) {}
+                    }
+                    // Wait a bit more after SIGKILL
+                    setTimeout(function () {
+                      isPortFree(port).then(function (free2) {
+                        if (!free2) {
+                          log(sym.warn + "  " + a.yellow + "Port " + port + " still in use. Kill the process manually:" + a.reset);
+                          log(sym.bar + "    " + a.bold + "lsof -ti:" + port + " | xargs kill -9" + a.reset);
+                        }
+                        cb();
+                      });
+                    }, 1000);
+                    return;
+                  }
+                  setTimeout(check, 500);
                 });
-                if (restorable.length > 0) {
-                  promptRestoreProjects(restorable, function (selected) {
-                    forkDaemon(mode, keepAwake, selected, false, wantOsUsers);
-                  });
-                } else {
-                  log(sym.bar);
-                  log(sym.end + "  " + a.dim + "Starting relay..." + a.reset);
-                  log("");
-                  forkDaemon(mode, keepAwake, undefined, true, wantOsUsers);
-                }
-              });
-            }).catch(function () {
+              }
+              check();
+            }
+
+            // Helper: run setup wizard after daemon is dead
+            function proceedWithSetup() {
               clearStaleConfig();
               setup(function (mode, keepAwake, wantOsUsers) {
                 var rc = loadClayrc();
@@ -2647,6 +2731,17 @@ function showSettingsMenu(config, ip) {
                   forkDaemon(mode, keepAwake, undefined, true, wantOsUsers);
                 }
               });
+            }
+
+            // Shut down the daemon, then wait for port to be free
+            sendIPCCommand(socketPath(), { cmd: "shutdown" }).then(function () {
+              waitForPortFree(proceedWithSetup);
+            }).catch(function () {
+              // IPC failed, daemon may be unresponsive. Try SIGTERM, then wait.
+              if (oldPid) {
+                try { process.kill(oldPid, "SIGTERM"); } catch (e) {}
+              }
+              waitForPortFree(proceedWithSetup);
             });
           } else {
             showSettingsMenu(config, ip);
@@ -2654,6 +2749,26 @@ function showSettingsMenu(config, ip) {
         });
         break;
 
+      case "show_setup_code":
+        // getSetupCode() auto-generates if multi-user is on and no code exists
+        var currentCode = getSetupCode();
+        log(sym.bar);
+        if (currentCode) {
+          log(sym.bar + "  " + a.yellow + sym.warn + " Setup code:  " + a.bold + currentCode + a.reset);
+          if (hasAdmin()) {
+            log(sym.bar + "  " + a.dim + "Admin account exists. This code is for adding the next admin." + a.reset);
+          } else {
+            log(sym.bar + "  " + a.dim + "Enter this code in the browser to create the admin account." + a.reset);
+          }
+        } else {
+          log(sym.bar + "  " + a.dim + "Multi-user mode is not enabled." + a.reset);
+        }
+        log(sym.bar);
+        promptSelect("Back?", [{ label: "Back", value: "back" }], function () {
+          showSettingsMenu(config, ip);
+        });
+        break;
+
       case "logs":
         console.clear();
         log(a.bold + "Daemon logs" + a.reset + " " + a.dim + "(" + logPath() + ")" + a.reset);

package/lib/config.js

@@ -6,22 +6,28 @@ var net = require("net");
 // When running under sudo, resolve the real user's home directory
 // so that ~/.clay/ points to the original user's data, not /root/.clay/
 function getRealHome() {
-  if (process.env.SUDO_USER) {
+  var sudoUser = process.env.SUDO_USER;
+  if (sudoUser && sudoUser !== "root") {
+    // 1. Try getent passwd (works on most Linux, may fail with some NSS configs)
     try {
       var entry = require("child_process")
-        .execSync("getent passwd " + process.env.SUDO_USER, { encoding: "utf8" })
+        .execSync("getent passwd " + sudoUser, { encoding: "utf8", timeout: 3000 })
         .trim();
       var home = entry.split(":")[5];
-      if (home) return home;
-    } catch (e) {
-      // getent failed (e.g. macOS), try user home dir from ~SUDO_USER
-      try {
-        var home = require("child_process")
-          .execSync("eval echo ~" + process.env.SUDO_USER, { encoding: "utf8" })
-          .trim();
-        if (home && home !== "~" + process.env.SUDO_USER) return home;
-      } catch (e2) {}
-    }
+      if (home && fs.existsSync(home)) return home;
+    } catch (e) {}
+    // 2. Try shell expansion of ~USER
+    try {
+      var home = require("child_process")
+        .execSync("eval echo ~" + sudoUser, { encoding: "utf8", timeout: 3000 })
+        .trim();
+      if (home && home !== "~" + sudoUser && fs.existsSync(home)) return home;
+    } catch (e2) {}
+    // 3. Direct path fallback (GCE, cloud VMs)
+    var directHome = "/home/" + sudoUser;
+    if (fs.existsSync(directHome)) return directHome;
+    // 4. SUDO_USER's original HOME (some sudo configs preserve it)
+    if (process.env.SUDO_HOME && fs.existsSync(process.env.SUDO_HOME)) return process.env.SUDO_HOME;
   }
   return os.homedir();
 }
@@ -29,7 +35,11 @@ function getRealHome() {
 var REAL_HOME = getRealHome();
 
 // v3: ~/.clay/  (v2 was ~/.claude-relay/, v1 was {cwd}/.claude-relay/)
-var CLAY_HOME = process.env.CLAY_HOME || path.join(REAL_HOME, ".clay");
+// If CLAY_CONFIG is set (daemon mode), derive CLAY_HOME from it so that
+// daemon.json, users.json, sessions/, etc. all live in the same directory.
+var CLAY_HOME = process.env.CLAY_HOME
+  || (process.env.CLAY_CONFIG ? path.dirname(process.env.CLAY_CONFIG) : null)
+  || path.join(REAL_HOME, ".clay");
 var LEGACY_HOME = path.join(REAL_HOME, ".claude-relay");
 
 // Auto-migrate v2 -> v3: rename ~/.claude-relay/ to ~/.clay/ (once, before anything reads)

package/lib/daemon.js

@@ -33,6 +33,7 @@ var usersModule = require("./users");
 var { scanWorktrees, createWorktree, removeWorktree, isWorktree } = require("./worktree");
 var mates = require("./mates");
 
+var daemonVersion = require("../package.json").version;
 var configFile = process.env.CLAY_CONFIG || process.env.CLAUDE_RELAY_CONFIG || require("./config").configPath();
 var config;
 
@@ -42,6 +43,12 @@ try {
   console.error("[daemon] Failed to read config:", e.message);
   process.exit(1);
 }
+console.log("[daemon] v" + daemonVersion + " PID " + process.pid + " config " + configFile);
+
+console.log("[daemon] Config: " + configFile);
+console.log("[daemon] Users: " + usersModule.USERS_FILE);
+if (process.env.SUDO_USER) console.log("[daemon] SUDO_USER: " + process.env.SUDO_USER);
+console.log("[daemon] UID: " + (typeof process.getuid === "function" ? process.getuid() : "N/A"));
 
 // --- OS users mode: check required system dependencies ---
 if (config.osUsers) {
@@ -1020,6 +1027,7 @@ if (existingConfig && existingConfig.pid && existingConfig.pid !== process.pid)
   }
 }
 var ipc = createIPCServer(socketPath(), function (msg) {
+  console.log("[daemon] IPC:", msg.cmd);
   switch (msg.cmd) {
     case "add_project": {
       if (!msg.path) return { ok: false, error: "missing path" };
@@ -1129,45 +1137,8 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       config.osUsers = enableOsUsers;
       saveConfig(config);
       console.log("[daemon] OS users:", enableOsUsers);
-      if (enableOsUsers) {
-        // Ensure shared projects directory exists
-        try { ensureProjectsDir(); } catch (e) {
-          console.error("[daemon] Failed to create projects dir:", e.message);
-        }
-        // Auto-provision Linux accounts for all existing users
-        var provisionResult = provisionAllUsers(usersModule);
-        console.log("[daemon] Provisioning result: " +
-          provisionResult.provisioned.length + " provisioned, " +
-          provisionResult.skipped.length + " skipped, " +
-          provisionResult.errors.length + " errors");
-        // Set up ACLs for all existing projects
-        for (var pi = 0; pi < config.projects.length; pi++) {
-          var proj = config.projects[pi];
-          var projPath = proj.path;
-          var projVisibility = proj.visibility || "public";
-          // Grant ACL to project owner
-          if (proj.ownerId) {
-            var ownerUser = usersModule.findUserById(proj.ownerId);
-            if (ownerUser && ownerUser.linuxUser) {
-              grantProjectAccess(projPath, ownerUser.linuxUser);
-            }
-          }
-          // Public projects: grant ACL to all users
-          if (projVisibility === "public") {
-            grantAllUsersAccess(projPath, usersModule);
-          } else {
-            // Private projects: grant ACL to allowedUsers
-            var projAllowed = proj.allowedUsers || [];
-            for (var ai = 0; ai < projAllowed.length; ai++) {
-              var allowedUser = usersModule.findUserById(projAllowed[ai]);
-              if (allowedUser && allowedUser.linuxUser) {
-                grantProjectAccess(projPath, allowedUser.linuxUser);
-              }
-            }
-          }
-        }
-        return { ok: true, provisioning: provisionResult };
-      }
+      // Provisioning is handled by CLI (which has terminal access for progress).
+      // Daemon only saves the flag. On next restart, daemon will pick it up.
       return { ok: true };
     }
 
@@ -1292,37 +1263,49 @@ function startListening() {
     config.pid = process.pid;
     saveConfig(config);
 
-    // Auto-provision Linux accounts on startup if OS users mode is enabled
+    // Auto-provision Linux accounts on startup if OS users mode is enabled.
+    // Run in setTimeout so the event loop stays free for IPC during startup.
     if (config.osUsers) {
-      try { ensureProjectsDir(); } catch (e) {}
-      var provResult = provisionAllUsers(usersModule);
-      if (provResult.provisioned.length > 0) {
-        console.log("[daemon] Auto-provisioned " + provResult.provisioned.length + " Linux account(s) on startup");
-      }
-      if (provResult.errors.length > 0) {
-        console.error("[daemon] Failed to provision " + provResult.errors.length + " account(s)");
-      }
-      // Set up ACLs for all existing projects on startup
-      for (var pi = 0; pi < config.projects.length; pi++) {
-        var proj = config.projects[pi];
-        if (proj.ownerId) {
-          var ownerUser = usersModule.findUserById(proj.ownerId);
-          if (ownerUser && ownerUser.linuxUser) {
-            grantProjectAccess(proj.path, ownerUser.linuxUser);
+      setTimeout(function () {
+        try { ensureProjectsDir(); } catch (e) {}
+        try {
+          var provResult = provisionAllUsers(usersModule);
+          if (provResult.provisioned.length > 0) {
+            console.log("[daemon] Auto-provisioned " + provResult.provisioned.length + " Linux account(s) on startup");
           }
+          if (provResult.errors.length > 0) {
+            console.error("[daemon] Failed to provision " + provResult.errors.length + " account(s)");
+          }
+        } catch (provErr) {
+          console.error("[daemon] Startup provisioning error:", provErr.message);
         }
-        if ((proj.visibility || "public") === "public") {
-          grantAllUsersAccess(proj.path, usersModule);
-        } else {
-          var projAllowed = proj.allowedUsers || [];
-          for (var ai = 0; ai < projAllowed.length; ai++) {
-            var allowedUser = usersModule.findUserById(projAllowed[ai]);
-            if (allowedUser && allowedUser.linuxUser) {
-              grantProjectAccess(proj.path, allowedUser.linuxUser);
+        // Set up ACLs for all existing projects on startup
+        for (var pi = 0; pi < config.projects.length; pi++) {
+          var proj = config.projects[pi];
+          try {
+            if (proj.ownerId) {
+              var ownerUser = usersModule.findUserById(proj.ownerId);
+              if (ownerUser && ownerUser.linuxUser) {
+                grantProjectAccess(proj.path, ownerUser.linuxUser);
+              }
             }
+            if ((proj.visibility || "public") === "public") {
+              grantAllUsersAccess(proj.path, usersModule);
+            } else {
+              var projAllowed = proj.allowedUsers || [];
+              for (var ai = 0; ai < projAllowed.length; ai++) {
+                var allowedUser = usersModule.findUserById(projAllowed[ai]);
+                if (allowedUser && allowedUser.linuxUser) {
+                  grantProjectAccess(proj.path, allowedUser.linuxUser);
+                }
+              }
+            }
+          } catch (aclErr) {
+            console.error("[daemon] Startup ACL error for " + proj.path + ":", aclErr.message);
           }
         }
-      }
+        console.log("[daemon] Startup OS users provisioning complete.");
+      }, 100);
     }
 
     // Check for crash info from a previous crash and notify clients

package/lib/ipc.js

@@ -74,7 +74,8 @@ function createIPCServer(sockPath, handler) {
  * Send a command to the daemon IPC server and wait for response.
  * Returns a Promise resolving to the parsed response.
  */
-function sendIPCCommand(sockPath, message) {
+function sendIPCCommand(sockPath, message, timeout) {
+  var timeoutMs = timeout || 3000;
   return new Promise(function (resolve) {
     var client = net.connect(sockPath);
     var buffer = "";
@@ -86,7 +87,7 @@ function sendIPCCommand(sockPath, message) {
         client.destroy();
         resolve({ ok: false, error: "timeout" });
       }
-    }, 3000);
+    }, timeoutMs);
 
     client.on("connect", function () {
       client.write(JSON.stringify(message) + "\n");

package/lib/os-users.js

@@ -157,11 +157,30 @@ function checkAclSupport() {
   }
 }
 
+/**
+ * Check if a path is a user's home directory (e.g. /home/chad, /root).
+ * Running recursive setfacl on a home dir is dangerous and slow.
+ */
+function isHomeDirectory(dirPath) {
+  var resolved = path.resolve(dirPath);
+  // /root
+  if (resolved === "/root") return true;
+  // /home/username (exactly two levels)
+  var parts = resolved.split("/");
+  if (parts.length === 3 && parts[0] === "" && parts[1] === "home" && parts[2]) return true;
+  return false;
+}
+
 /**
  * Grant a Linux user ACL access (rwX) to a project directory.
  * Uses setfacl to add recursive + default ACL entries.
+ * Skips home directories to avoid slow recursive ACL on large trees.
  */
 function grantProjectAccess(projectPath, linuxUser) {
+  if (isHomeDirectory(projectPath)) {
+    console.log("[os-users] Skipping ACL for home directory: " + projectPath);
+    return;
+  }
   try {
     // Recursive ACL for existing files
     execSync("setfacl -R -m u:" + linuxUser + ":rwX " + JSON.stringify(projectPath), {
@@ -190,6 +209,10 @@ function grantProjectAccess(projectPath, linuxUser) {
  * Revoke a Linux user's ACL access from a project directory.
  */
 function revokeProjectAccess(projectPath, linuxUser) {
+  if (isHomeDirectory(projectPath)) {
+    console.log("[os-users] Skipping ACL revoke for home directory: " + projectPath);
+    return;
+  }
   try {
     execSync("setfacl -R -x u:" + linuxUser + " " + JSON.stringify(projectPath), {
       encoding: "utf8",
@@ -424,4 +447,5 @@ module.exports = {
   installClaudeCli: installClaudeCli,
   deactivateLinuxUser: deactivateLinuxUser,
   ensureProjectsDir: ensureProjectsDir,
+  isHomeDirectory: isHomeDirectory,
 };

package/lib/users.js

@@ -115,7 +115,15 @@ function generateSetupCode() {
 
 function getSetupCode() {
   var data = loadUsers();
-  return data.setupCode || null;
+  if (data.setupCode) return data.setupCode;
+  // Defensive: if multi-user is on, no admin, and no code, auto-generate one
+  if (data.multiUser && !findAdmin(data)) {
+    var code = generateSetupCode();
+    data.setupCode = code;
+    saveUsers(data);
+    return code;
+  }
+  return null;
 }
 
 function clearSetupCode() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.20.0",
+  "version": "2.20.1-beta.10",
   "description": "Web UI for Claude Code. Any device. Push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",