clay-server 2.20.1-beta.9 → 2.21.0-beta.2

package/bin/cli.js

@@ -1641,7 +1641,7 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
 // ==============================
 // Dev mode — foreground daemon with file watching
 // ==============================
-async function devMode(mode, keepAwake, existingPinHash) {
+async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
   var ip = getLocalIP();
   var hasTls = false;
   var hasBuiltinCert = false;
@@ -1723,6 +1723,7 @@ async function devMode(mode, keepAwake, existingPinHash) {
     mode: mode || "single",
     setupCompleted: true,
     projects: allProjects,
+    osUsers: wantOsUsers || (prevDevConfig ? (prevDevConfig.osUsers || false) : false),
   };
 
   ensureConfigDir();
@@ -2594,6 +2595,10 @@ function showSettingsMenu(config, ip) {
                 log(sym.bar + "  " + a.dim + "Setting ACLs for " + cfgProjects.length + " project(s)..." + a.reset);
                 for (var pi = 0; pi < cfgProjects.length; pi++) {
                   var proj = cfgProjects[pi];
+                  if (osUsersLib.isHomeDirectory(proj.path)) {
+                    log(sym.bar + "    " + a.dim + "~ " + (proj.slug || proj.path) + " (home dir, skipped)" + a.reset);
+                    continue;
+                  }
                   try {
                     if (proj.visibility === "public") {
                       osUsersLib.grantAllUsersAccess(proj.path, usersLib);
@@ -2873,11 +2878,11 @@ var currentVersion = require("../package.json").version;
     // No config — go through setup (disclaimer, port, mode, etc.)
     if (!devConfig) {
       setup(function (mode, keepAwake, wantOsUsers) {
-        devMode(mode, keepAwake, null);
+        devMode(mode, keepAwake, null, wantOsUsers);
       });
     } else {
       // Reuse existing config (repeat run)
-      await devMode(devConfig.mode || "single", devConfig.keepAwake || false, devConfig.pinHash || null);
+      await devMode(devConfig.mode || "single", devConfig.keepAwake || false, devConfig.pinHash || null, devConfig.osUsers || false);
     }
     return;
   }

package/lib/daemon.js

@@ -1399,7 +1399,7 @@ function spawnAndRestart() {
 var updateHandoff = false; // true when shutting down for update (new daemon already spawned)
 
 function gracefulShutdown() {
-  console.log("[daemon] Shutting down...");
+  try { console.log("[daemon] Shutting down..."); } catch (e) {}
   var exitCode = updateHandoff ? 120 : 0; // 120 = update handoff, don't auto-restart
 
   if (caffeinateProc) {
@@ -1426,13 +1426,13 @@ function gracefulShutdown() {
   }
 
   relay.server.close(function () {
-    console.log("[daemon] Server closed");
+    try { console.log("[daemon] Server closed"); } catch (e) {}
     process.exit(exitCode);
   });
 
   // Force exit after 5 seconds
   setTimeout(function () {
-    console.error("[daemon] Forced exit after timeout");
+    try { console.error("[daemon] Forced exit after timeout"); } catch (e) {}
     process.exit(1);
   }, 5000);
 }
@@ -1462,7 +1462,14 @@ process.on("uncaughtException", function (err) {
     // A single session's SDK write was aborted (e.g. stream closed before
     // write completed). This is recoverable, so do NOT tear down the whole
     // daemon and kill every other session.
-    console.error("[daemon] Suppressed AbortError (single-session failure):", errMsg);
+    try { console.error("[daemon] Suppressed AbortError (single-session failure):", errMsg); } catch (e) {}
+    return;
+  }
+
+  // EIO/EPIPE on stdout/stderr when parent process (dev mode CLI) dies.
+  // Not fatal for the daemon itself.
+  var isIOError = errMsg.indexOf("EIO") !== -1 || errMsg.indexOf("EPIPE") !== -1;
+  if (isIOError) {
     return;
   }
 

package/lib/os-users.js

@@ -2,6 +2,7 @@
 // Used by sdk-bridge.js (worker spawning), terminal-manager.js, and project.js (file ops).
 
 var fs = require("fs");
+var path = require("path");
 var { execSync } = require("child_process");
 
 /**
@@ -157,11 +158,30 @@ function checkAclSupport() {
   }
 }
 
+/**
+ * Check if a path is a user's home directory (e.g. /home/chad, /root).
+ * Running recursive setfacl on a home dir is dangerous and slow.
+ */
+function isHomeDirectory(dirPath) {
+  var resolved = path.resolve(dirPath);
+  // /root
+  if (resolved === "/root") return true;
+  // /home/username (exactly two levels)
+  var parts = resolved.split("/");
+  if (parts.length === 3 && parts[0] === "" && parts[1] === "home" && parts[2]) return true;
+  return false;
+}
+
 /**
  * Grant a Linux user ACL access (rwX) to a project directory.
  * Uses setfacl to add recursive + default ACL entries.
+ * Skips home directories to avoid slow recursive ACL on large trees.
  */
 function grantProjectAccess(projectPath, linuxUser) {
+  if (isHomeDirectory(projectPath)) {
+    console.log("[os-users] Skipping ACL for home directory: " + projectPath);
+    return;
+  }
   try {
     // Recursive ACL for existing files
     execSync("setfacl -R -m u:" + linuxUser + ":rwX " + JSON.stringify(projectPath), {
@@ -190,6 +210,10 @@ function grantProjectAccess(projectPath, linuxUser) {
  * Revoke a Linux user's ACL access from a project directory.
  */
 function revokeProjectAccess(projectPath, linuxUser) {
+  if (isHomeDirectory(projectPath)) {
+    console.log("[os-users] Skipping ACL revoke for home directory: " + projectPath);
+    return;
+  }
   try {
     execSync("setfacl -R -x u:" + linuxUser + " " + JSON.stringify(projectPath), {
       encoding: "utf8",
@@ -242,6 +266,25 @@ function linuxUserExists(username) {
   }
 }
 
+function getLinuxUserHome(username) {
+  try {
+    var line = execSync("getent passwd " + username, { encoding: "utf8", timeout: 5000, stdio: "pipe" }).trim();
+    var parts = line.split(":");
+    return parts[5] || "/home/" + username;
+  } catch (e) {
+    return "/home/" + username;
+  }
+}
+
+function getLinuxUserUid(username) {
+  try {
+    var uid = execSync("id -u " + username, { encoding: "utf8", timeout: 5000, stdio: "pipe" }).trim();
+    return parseInt(uid, 10);
+  } catch (e) {
+    return null;
+  }
+}
+
 /**
  * Install Claude CLI for a Linux user account.
  * Downloads and runs the install script, then ensures PATH is configured.
@@ -424,4 +467,7 @@ module.exports = {
   installClaudeCli: installClaudeCli,
   deactivateLinuxUser: deactivateLinuxUser,
   ensureProjectsDir: ensureProjectsDir,
+  isHomeDirectory: isHomeDirectory,
+  getLinuxUserHome: getLinuxUserHome,
+  getLinuxUserUid: getLinuxUserUid,
 };

package/lib/sdk-bridge.js

@@ -613,22 +613,32 @@ function createSDKBridge(opts) {
       var dirs = [];
       while (dir !== path.dirname(dir)) {
         dirs.push(dir);
-        // Stop once we leave the npm cache tree
-        if (dir.indexOf(".npm") === -1 && dir.indexOf("node_modules") === -1) break;
         dir = path.dirname(dir);
       }
+      // Open o+rx on each ancestor so non-root users can traverse the path
+      // (e.g. /root/.npm/_npx/.../node_modules/clay-server needs /root to be o+x)
       for (var di = 0; di < dirs.length; di++) {
         try {
           var st = fs.statSync(dirs[di]);
-          // Add o+rx if not already present
-          if ((st.mode & 0o005) !== 0o005) {
-            fs.chmodSync(dirs[di], st.mode | 0o005);
+          // Add o+x (traverse) to all ancestors, o+rx to npm cache dirs
+          var isNpmDir = dirs[di].indexOf(".npm") !== -1 || dirs[di].indexOf("node_modules") !== -1;
+          var needed = isNpmDir ? 0o005 : 0o001; // rx for npm dirs, just x for ancestors like /root
+          if ((st.mode & needed) !== needed) {
+            fs.chmodSync(dirs[di], st.mode | needed);
           }
         } catch (e) {}
       }
-      // Recursively make the package contents readable
+      // Recursively make the package AND hoisted dependencies readable.
+      // npm/npx may hoist deps (e.g. @anthropic-ai/claude-agent-sdk) to the
+      // parent node_modules/ instead of inside clay-server/node_modules/.
       var { execSync: chmodExec } = require("child_process");
-      chmodExec("chmod -R o+rX " + JSON.stringify(pkgDir), { stdio: "ignore", timeout: 5000 });
+      // Find the top-level node_modules that contains clay-server
+      var topNodeModules = path.join(pkgDir, "..");
+      if (path.basename(topNodeModules) === "node_modules") {
+        chmodExec("chmod -R o+rX " + JSON.stringify(topNodeModules), { stdio: "ignore", timeout: 15000 });
+      } else {
+        chmodExec("chmod -R o+rX " + JSON.stringify(pkgDir), { stdio: "ignore", timeout: 5000 });
+      }
     } catch (e) {}
   })();
 
@@ -697,15 +707,17 @@ function createSDKBridge(opts) {
       // Set socket permissions so the target user can connect
       try { fs.chmodSync(socketPath, 0o777); } catch (e) {}
 
-      // Spawn worker process as the target Linux user
-      var workerEnv = {
+      // Spawn worker process as the target Linux user.
+      // Inherit full env from daemon, override user-specific vars.
+      var workerEnv = Object.assign({}, process.env, {
         HOME: userInfo.home,
         USER: linuxUser,
-        PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin",
-        NODE_PATH: process.env.NODE_PATH || "",
-        LANG: process.env.LANG || "en_US.UTF-8",
-      };
+        LOGNAME: linuxUser,
+      });
 
+      console.log("[sdk-bridge] Spawning worker: uid=" + userInfo.uid + " gid=" + userInfo.gid + " cwd=" + cwd + " socket=" + socketPath);
+      console.log("[sdk-bridge] Worker script: " + WORKER_SCRIPT);
+      console.log("[sdk-bridge] Node: " + process.execPath);
       worker.process = spawn(process.execPath, [WORKER_SCRIPT, socketPath], {
         uid: userInfo.uid,
         gid: userInfo.gid,
@@ -725,8 +737,24 @@ function createSDKBridge(opts) {
       });
 
       worker.process.on("exit", function(code, signal) {
-        console.log("[sdk-bridge] Worker for " + linuxUser + " exited (code=" + code + ", signal=" + signal + ")");
+        console.log("[sdk-bridge] Worker for " + linuxUser + " exited (code=" + code + ", signal=" + signal + ")" + (worker._stderrBuf ? " stderr: " + worker._stderrBuf.trim() : ""));
+        // Reject readyPromise if worker dies before becoming ready
+        if (!worker.ready && worker._readyResolve) {
+          worker._readyResolve = null;
+          // Let the readyPromise hang; the query_error handler will clean up
+        }
         // Notify message handlers about unexpected exit so sessions don't hang
+        if (code === 0 && !worker.ready) {
+          // Worker exited cleanly before sending "ready" — something is wrong
+          for (var h = 0; h < worker.messageHandlers.length; h++) {
+            worker.messageHandlers[h]({
+              type: "query_error",
+              error: "Worker exited before ready (code=0). stderr: " + (worker._stderrBuf || "(none)"),
+              exitCode: 0,
+              stderr: worker._stderrBuf || null,
+            });
+          }
+        }
         if (code !== 0 && code !== null) {
           var stderrText = worker._stderrBuf || "";
           for (var h = 0; h < worker.messageHandlers.length; h++) {
@@ -786,6 +814,9 @@ function createSDKBridge(opts) {
    * Mirrors the in-process startQuery flow but delegates SDK execution to the worker.
    */
   async function startQueryViaWorker(session, text, images, linuxUser) {
+    // Save for auto-retry on session-not-found
+    session._lastQueryText = text;
+    session._lastQueryImages = images;
     var worker;
     try {
       worker = spawnWorker(linuxUser);
@@ -929,7 +960,69 @@ function createSDKBridge(opts) {
           }
           break;
 
-        case "query_error":
+        case "query_error": {
+          // Check session-not-found before isProcessing gate (it can arrive after processing is cleared)
+          var qerrLower = (msg.error || "").toLowerCase();
+          var isSessionNotFound = qerrLower.indexOf("no conversation found") !== -1
+            || qerrLower.indexOf("session not found") !== -1;
+          if (isSessionNotFound && !session._sessionMigrateRetried) {
+            // Auto-retry: copy CLI session file to OS user's home, then resume
+            console.log("[sdk-bridge] Session not found for OS user, migrating CLI session for session " + session.localId);
+            session._sessionMigrateRetried = true;
+            // Try to copy the CLI session file from original user to OS user
+            var migratedOk = false;
+            if (session.cliSessionId && session.lastLinuxUser) {
+              try {
+                var configMod = require("./config");
+                var osUsersMod = require("./os-users");
+                var originalHome = configMod.REAL_HOME || require("os").homedir();
+                var linuxUserHome = osUsersMod.getLinuxUserHome ? osUsersMod.getLinuxUserHome(session.lastLinuxUser) : "/home/" + session.lastLinuxUser;
+                var projectDir = session.cwd || "";
+                var projectSlug = projectDir.replace(/\//g, "-");
+                var srcFile = path.join(originalHome, ".claude", "projects", projectSlug, session.cliSessionId + ".jsonl");
+                var dstDir = path.join(linuxUserHome, ".claude", "projects", projectSlug);
+                var dstFile = path.join(dstDir, session.cliSessionId + ".jsonl");
+                if (fs.existsSync(srcFile) && !fs.existsSync(dstFile)) {
+                  fs.mkdirSync(dstDir, { recursive: true });
+                  fs.copyFileSync(srcFile, dstFile);
+                  // Fix ownership so the OS user can read/write it
+                  var uid = osUsersMod.getLinuxUserUid ? osUsersMod.getLinuxUserUid(session.lastLinuxUser) : null;
+                  if (uid != null) {
+                    try { require("child_process").execSync("chown -R " + uid + " " + JSON.stringify(dstDir)); } catch (e2) {}
+                  }
+                  console.log("[sdk-bridge] Copied CLI session " + session.cliSessionId + " to " + dstFile);
+                  migratedOk = true;
+                } else if (fs.existsSync(dstFile)) {
+                  migratedOk = true; // already there
+                }
+              } catch (copyErr) {
+                console.error("[sdk-bridge] Failed to copy CLI session:", copyErr.message);
+              }
+            }
+            // Detach old worker so its exit event doesn't interfere with the new one
+            if (session.worker) {
+              session.worker.messageHandlers = [];
+              session.worker.kill();
+              session.worker = null;
+            }
+            session.queryInstance = null;
+            session.messageQueue = null;
+            session.abortController = null;
+            // Ensure client knows we're still processing (re-send status)
+            session.isProcessing = true;
+            onProcessingChanged();
+            send({ type: "status", status: "processing" });
+            // If migration failed, clear cliSessionId so it starts fresh
+            if (!migratedOk) {
+              session.cliSessionId = null;
+            }
+            // Re-run the query (with resume if migration succeeded)
+            var retryText = session._lastQueryText || "";
+            var retryImages = session._lastQueryImages || undefined;
+            var retryLinuxUser = session.lastLinuxUser || null;
+            startQuery(session, retryText, retryImages, retryLinuxUser);
+            break;
+          }
           if (session.isProcessing) {
             session.isProcessing = false;
             onProcessingChanged();
@@ -1014,6 +1107,7 @@ function createSDKBridge(opts) {
             }
           }
           break;
+        }
 
         case "model_changed":
           sm.currentModel = msg.model;
@@ -1055,6 +1149,8 @@ function createSDKBridge(opts) {
       prompt: initialMessage,
       options: queryOptions,
       singleTurn: !!session.singleTurn,
+      originalHome: require("./config").REAL_HOME || null,
+      projectPath: session.cwd || null,
     });
   }
 

package/lib/sdk-worker.js

@@ -4,6 +4,9 @@
 //
 // Usage: node sdk-worker.js <socket-path>
 
+// Early diagnostic — writes directly to fd 2 to ensure output even if pipes close fast
+try { require("fs").writeSync(2, "[sdk-worker] BOOT pid=" + process.pid + " uid=" + (typeof process.getuid === "function" ? process.getuid() : "?") + " argv=" + process.argv.slice(1).join(" ") + "\n"); } catch (e) {}
+
 var net = require("net");
 var crypto = require("crypto");
 var path = require("path");
@@ -217,6 +220,31 @@ async function handleQueryStart(msg) {
     messageQueue.push(msg.prompt);
   }
 
+  // If resuming a session that doesn't exist for this OS user, try to migrate
+  // the session file from the original user's home directory.
+  if (msg.options && msg.options.resume && msg.originalHome && msg.projectPath) {
+    try {
+      var fs = require("fs");
+      var homePath = require("os").homedir();
+      if (homePath !== msg.originalHome) {
+        var projDirName = msg.projectPath.replace(/\//g, "-");
+        var sessionFile = msg.options.resume + ".jsonl";
+        var destDir = path.join(homePath, ".claude", "projects", projDirName);
+        var destFile = path.join(destDir, sessionFile);
+        if (!fs.existsSync(destFile)) {
+          var srcFile = path.join(msg.originalHome, ".claude", "projects", projDirName, sessionFile);
+          if (fs.existsSync(srcFile)) {
+            fs.mkdirSync(destDir, { recursive: true });
+            fs.copyFileSync(srcFile, destFile);
+            try { fs.writeSync(2, "[sdk-worker] Migrated session " + msg.options.resume + " from " + msg.originalHome + "\n"); } catch (e2) {}
+          }
+        }
+      }
+    } catch (migrateErr) {
+      try { fs.writeSync(2, "[sdk-worker] Session migration failed: " + migrateErr.message + "\n"); } catch (e2) {}
+    }
+  }
+
   // Build query options (callbacks are local, everything else from daemon)
   var options = msg.options || {};
   options.abortController = abortController;
@@ -391,6 +419,9 @@ async function handleWarmup(msg) {
 
 // --- Cleanup ---
 function cleanup() {
+  if (_keepAlive) {
+    try { clearInterval(_keepAlive); } catch (e) {}
+  }
   if (abortController) {
     try { abortController.abort(); } catch (e) {}
   }
@@ -402,8 +433,14 @@ function cleanup() {
   }
 }
 
+// Keep event loop alive — without this, Node may exit if the socket handle
+// gets unreferenced (observed on Linux with uid/gid spawn)
+var _keepAlive = setInterval(function() {}, 30000);
+
 // --- Connect to daemon socket ---
+try { require("fs").writeSync(2, "[sdk-worker] Connecting to socket: " + socketPath + "\n"); } catch (e) {}
 conn = net.connect(socketPath, function() {
+  try { require("fs").writeSync(2, "[sdk-worker] Connected, sending ready\n"); } catch (e) {}
   sendToDaemon({ type: "ready" });
 });
 
@@ -429,18 +466,20 @@ conn.on("error", function(err) {
 });
 
 conn.on("close", function() {
-  console.log("[sdk-worker] Socket closed, shutting down");
+  try { require("fs").writeSync(2, "[sdk-worker] EXIT REASON: socket closed\n"); } catch (e) {}
   cleanup();
   process.exit(0);
 });
 
 // Handle process signals
 process.on("SIGTERM", function() {
+  try { require("fs").writeSync(2, "[sdk-worker] EXIT REASON: SIGTERM\n"); } catch (e) {}
   cleanup();
   process.exit(0);
 });
 
 process.on("SIGINT", function() {
+  try { require("fs").writeSync(2, "[sdk-worker] EXIT REASON: SIGINT\n"); } catch (e) {}
   cleanup();
   process.exit(0);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.20.1-beta.9",
+  "version": "2.21.0-beta.2",
   "description": "Web UI for Claude Code. Any device. Push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",