clay-server 2.22.2 → 2.22.3-beta.1

package/lib/build-user-env.js

@@ -0,0 +1,57 @@
+// build-user-env.js — Build a minimal, safe environment for user subprocesses.
+// Prevents leaking the root daemon's full process.env to user sessions.
+
+var os = require("os");
+
+// Only these vars are forwarded from the daemon's environment.
+var ALLOWED_KEYS = ["PATH", "LANG", "NODE_ENV"];
+
+/**
+ * Build a clean env object for spawning a user process.
+ * osUserInfo: { uid, gid, home, user, shell } or null for same-user fallback.
+ */
+function buildUserEnv(osUserInfo) {
+  var env = {};
+
+  // Copy only allowlisted keys from daemon env
+  for (var i = 0; i < ALLOWED_KEYS.length; i++) {
+    var key = ALLOWED_KEYS[i];
+    if (process.env[key]) env[key] = process.env[key];
+  }
+
+  // Copy all LC_* locale vars
+  var keys = Object.keys(process.env);
+  for (var j = 0; j < keys.length; j++) {
+    if (keys[j].indexOf("LC_") === 0) {
+      env[keys[j]] = process.env[keys[j]];
+    }
+  }
+
+  // Terminal settings
+  env.TERM = "xterm-256color";
+  env.COLORFGBG = "15;0"; // Suppress OSC 11 background-color queries
+
+  // User identity
+  if (osUserInfo) {
+    env.HOME = osUserInfo.home;
+    env.USER = osUserInfo.user;
+    env.LOGNAME = osUserInfo.user;
+    if (osUserInfo.shell) env.SHELL = osUserInfo.shell;
+  } else {
+    env.HOME = process.env.HOME || os.homedir();
+    env.USER = process.env.USER || "";
+    env.LOGNAME = process.env.LOGNAME || process.env.USER || "";
+    env.SHELL = process.env.SHELL || "/bin/bash";
+  }
+
+  // XDG runtime dir (needed for dbus, systemd user services, etc.)
+  if (osUserInfo) {
+    env.XDG_RUNTIME_DIR = "/run/user/" + osUserInfo.uid;
+  } else if (process.env.XDG_RUNTIME_DIR) {
+    env.XDG_RUNTIME_DIR = process.env.XDG_RUNTIME_DIR;
+  }
+
+  return env;
+}
+
+module.exports = { buildUserEnv: buildUserEnv };

package/lib/sdk-bridge.js

@@ -708,11 +708,13 @@ function createSDKBridge(opts) {
       try { fs.chmodSync(socketPath, 0o777); } catch (e) {}
 
       // Spawn worker process as the target Linux user.
-      // Inherit full env from daemon, override user-specific vars.
-      var workerEnv = Object.assign({}, process.env, {
-        HOME: userInfo.home,
-        USER: linuxUser,
-        LOGNAME: linuxUser,
+      // Build a minimal, isolated env (no daemon env leakage).
+      var workerEnv = require("./build-user-env").buildUserEnv({
+        uid: userInfo.uid,
+        gid: userInfo.gid,
+        home: userInfo.home,
+        user: linuxUser,
+        shell: userInfo.shell || "/bin/bash",
       });
 
       console.log("[sdk-bridge] Spawning worker: uid=" + userInfo.uid + " gid=" + userInfo.gid + " cwd=" + cwd + " socket=" + socketPath);

package/lib/terminal.js

@@ -5,14 +5,17 @@ try {
   pty = null;
 }
 
+var { buildUserEnv } = require("./build-user-env");
+
 function createTerminal(cwd, cols, rows, osUserInfo) {
   if (!pty) return null;
 
-  var shell = process.env.SHELL
+  // Determine shell: prefer target user's shell, then fallback
+  var shell = (osUserInfo && osUserInfo.shell)
     || (process.platform === "win32" ? process.env.COMSPEC || "cmd.exe" : "/bin/bash");
 
-  // OS-level user isolation: spawn terminal as the mapped Linux user
-  var termEnv = Object.assign({}, process.env, { TERM: "xterm-256color" });
+  // Build a minimal, isolated environment (no daemon env leakage)
+  var termEnv = buildUserEnv(osUserInfo);
   var spawnOpts = {
     name: "xterm-256color",
     cols: cols || 80,
@@ -24,12 +27,6 @@ function createTerminal(cwd, cols, rows, osUserInfo) {
   if (osUserInfo) {
     spawnOpts.uid = osUserInfo.uid;
     spawnOpts.gid = osUserInfo.gid;
-    // Use the target user's shell and home
-    termEnv.HOME = osUserInfo.home;
-    termEnv.USER = osUserInfo.user;
-    termEnv.LOGNAME = osUserInfo.user;
-    // Use target user's shell if available
-    if (osUserInfo.shell) shell = osUserInfo.shell;
   }
 
   var args = osUserInfo ? ["-l"] : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.22.2",
+  "version": "2.22.3-beta.1",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",