clay-server 2.42.0 → 2.43.0-beta.1

package/bin/cli.js

@@ -37,6 +37,7 @@ var { loadConfig, saveConfig, configPath, socketPath, logPath, ensureConfigDir,
 var { sendIPCCommand } = require("../lib/ipc");
 var { generateAuthToken } = require("../lib/server");
 var { enableMultiUser, disableMultiUser, hasAdmin, isMultiUser, getSetupCode } = require("../lib/users");
+var clayStudioCert = require("../lib/clay-studio-cert");
 
 function openUrl(url) {
   try {
@@ -567,6 +568,12 @@ function getAllIPs() {
 
 function getBuiltinCert() {
   try {
+    // Prefer the cert fetched at runtime from the clay.studio endpoint (always
+    // current) over the copy baked into the package (expires ~90 days after
+    // publish). forkDaemon refreshes this cache before we get here.
+    var fetched = clayStudioCert.cachedCertFiles();
+    if (fetched) return { key: fetched.key, cert: fetched.cert, caRoot: null, builtin: true };
+
     var certDir = path.join(__dirname, "..", "lib", "certs");
     var keyPath = path.join(certDir, "privkey.pem");
     var certPath = path.join(certDir, "fullchain.pem");
@@ -1458,13 +1465,19 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
   var mkcertDetected = false;
 
   if (useHttps) {
+    // Refresh the runtime cert cache from the clay.studio endpoint (best effort,
+    // short timeout) so getBuiltinCert picks up the current auto-renewed cert
+    // instead of the stale baked copy. Skipped when the user forces mkcert.
+    if (!forceMkcert) {
+      try { await clayStudioCert.refreshCache(5000); } catch (e) {}
+    }
     var certPaths = ensureCerts(ip);
     if (certPaths) {
       hasTls = true;
       if (certPaths.builtin) hasBuiltinCert = true;
       if (certPaths.mkcertDetected) mkcertDetected = true;
     } else {
-      log(sym.warn + "  " + a.yellow + "HTTPS unavailable" + a.reset + a.dim + " · mkcert not installed" + a.reset);
+      log(sym.warn + "  " + a.yellow + "HTTPS unavailable" + a.reset + a.dim + " · could not obtain a certificate" + a.reset);
     }
   }
 
@@ -1640,6 +1653,12 @@ async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
   var mkcertDetected = false;
 
   if (useHttps) {
+    // Refresh the runtime cert cache from the clay.studio endpoint (best effort,
+    // short timeout) so getBuiltinCert picks up the current auto-renewed cert
+    // instead of the stale baked copy. Skipped when the user forces mkcert.
+    if (!forceMkcert) {
+      try { await clayStudioCert.refreshCache(5000); } catch (e) {}
+    }
     var certPaths = ensureCerts(ip);
     if (certPaths) {
       hasTls = true;
@@ -1851,6 +1870,9 @@ async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
 // ==============================
 async function restartDaemonWithTLS(config, callback) {
   var ip = getLocalIP();
+  if (!forceMkcert) {
+    try { await clayStudioCert.refreshCache(5000); } catch (e) {}
+  }
   var certPaths = ensureCerts(ip);
   if (!certPaths) {
     callback(config);

package/lib/certs/fullchain.pem

@@ -1,47 +1,81 @@
 -----BEGIN CERTIFICATE-----
-MIIDgjCCAwigAwIBAgISBmtBLGUclrEfhwU9evzgyDCQMAoGCCqGSM49BAMDMDIx
-CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
-ODAeFw0yNjAzMjMwOTQ0MDJaFw0yNjA2MjEwOTQ0MDFaMBoxGDAWBgNVBAMMDyou
-ZC5jbGF5LnN0dWRpbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABEhAD1htqRg8
-n7evflBZ1X7UaCeqBGcvG/MNtlAKd1VVfVGFuanyUjksV9++R1EuKLhEPM3loL/3
-Gz8+XEewGw6jggIUMIICEDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYB
-BQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU8Anzwuqwtujb+h3o/CnbJu5Z
-+W8wHwYDVR0jBBgwFoAUjw0TovYuftFQbDMYOF1ZjiNykcowMgYIKwYBBQUHAQEE
-JjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTguaS5sZW5jci5vcmcvMBoGA1UdEQQT
-MBGCDyouZC5jbGF5LnN0dWRpbzATBgNVHSAEDDAKMAgGBmeBDAECATAtBgNVHR8E
-JjAkMCKgIKAehhxodHRwOi8vZTguYy5sZW5jci5vcmcvMTcuY3JsMIIBBQYKKwYB
-BAHWeQIEAgSB9gSB8wDxAHcAFoMtq/CpJQ8P8DqlRf/Iv8gj0IdL9gQpJ/jnHzMT
-9foAAAGdGkoIlgAABAMASDBGAiEAhJFJwEIag1Bzt0WtYgMzLdJn/k+Is2RukdDo
-G5sXpyMCIQCQOX9nOoaVIXxF1KXiavbAY5QIyJRuvK7Fn6WeL58YQQB2AMs49xWJ
-fIShRF9bwd37yW7ymlnNRwppBYWwyxTDFFjnAAABnRpKCJgAAAQDAEcwRQIhAI98
-cmflulGQJMfD10jbstVwodGpzl5licg6FTxcYachAiBZV1cZnPfasTzcteXyjCuz
-c1wayYAtch+0soAWvBKZRzAKBggqhkjOPQQDAwNoADBlAjAwJO4ti4AJJTtMxYsr
-Jf5052oDrD2POtoiPksruQVVacsq0T/9VYVX+X2vElCrxFwCMQDcSToBRWGpv/G3
-JBpbEAB1qhk1Z9lYPQKH6gRvtp35XJWY0PucGRWgQUrXuZcxGlA=
+MIIDjTCCAxOgAwIBAgISBrR9JEWSYT2n404PsSP43IdoMAoGCCqGSM49BAMDMDMx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ
+RTEwHhcNMjYwNjE4MDgwNTE5WhcNMjYwOTE2MDgwNTE4WjAaMRgwFgYDVQQDDA8q
+LmQuY2xheS5zdHVkaW8wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASrxxs5PE+8
+vMltWI5D+dynbZexsgegG4LmDP2+ZRt4OIWJA4e8qR39LP0W8IRtvhpjM0ifyImZ
+OFfgxX/NgtCBo4ICHjCCAhowDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFLBOYatEoih78WWUdl2JCeb5
+BuwyMB8GA1UdIwQYMBaAFLsgykcL/tflnPmPCSqjjDdFsbzYMDMGCCsGAQUFBwEB
+BCcwJTAjBggrBgEFBQcwAoYXaHR0cDovL3llMS5pLmxlbmNyLm9yZy8wGgYDVR0R
+BBMwEYIPKi5kLmNsYXkuc3R1ZGlvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC8GA1Ud
+HwQoMCYwJKAioCCGHmh0dHA6Ly95ZTEuYy5sZW5jci5vcmcvMTA1LmNybDCCAQwG
+CisGAQQB1nkCBAIEgf0EgfoA+AB1ANdtfRDRp/V3wsfpX9cAv/mCyTNaZeHQswFz
+F8DIxWl3AAABntn46hAAAAQDAEYwRAIgNEAWd2PrGbahnsSv/o3N8P64j+Um64f5
+9TflSDn/1q0CIFzPC7kF0N+CxxA4OHQ14SCqqON6B5l2GbqUMzecmeg6AH8ARq+G
+PTs+5Z+ld96oJF02sNntIqIj9GF3QSKUUu6VUF8AAAGe2fjqtAAIAAAFAAoXXMgE
+AwBIMEYCIQCQC8jNSHFzs8MHr7cs27Evzny0FlI/54qUnRHBXRzqfQIhANIGcX1I
+lWB71hzGllUGdH//wS5I1h3zytf4c4Lrh/wOMAoGCCqGSM49BAMDA2gAMGUCMQCV
+xIhF5thRy53+4Z0Vrtd57Tj2nCHitHw/duSx+Buqcvr0zXJZlHHpRuJ/vst6H2EC
+MG6sYJmeACHB9E/ZHPgjsZo+EZ3EWpCg29tyruOUIcH2wzt+dKoCumkau6H3rwPY
+AQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIEVjCCAj6gAwIBAgIQY5WTY8JOcIJxWRi/w9ftVjANBgkqhkiG9w0BAQsFADBP
+MIICizCCAhGgAwIBAgIQXd1w3TH4AchcGGp6BLgK/jAKBggqhkjOPQQDAzAuMQsw
+CQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTAeFw0y
+NTA5MDMwMDAwMDBaFw0yODA5MDIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYD
+VQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZRTEwdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQHZVB1/mimla2hfSurylScjPMZaOJXLz/NnAc2sylm8WDyhU9Ccp+z
+ASQi5vSwGGJjSGklkD9fdPR8GpyDIOIjCEfrnbt/v+ZSEPLLEGbaM6EccDbN7p9x
+teIm2Avf+ryjge4wgeswDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUF
+BwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFLsgykcL/tflnPmPCSqj
+jDdFsbzYMB8GA1UdIwQYMBaAFKPIJlqOoUzQNWP8myPIOq5W809WMDIGCCsGAQUF
+BwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3llLmkubGVuY3Iub3JnLzATBgNV
+HSAEDDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veWUuYy5s
+ZW5jci5vcmcvMAoGCCqGSM49BAMDA2gAMGUCMQDgjUEahFT/h3DRakqiPZpLvPgf
+Zwkt6K2EOMmh1nvEzl83eMLYcod4GCl3b0J1Nn0CMBNYmEQJb4CEG5WoOe7aRn/L
+VKu6saHmHEynI7ysIPd8zQsK1HdmhlHKlw9Z5GpGvA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICpjCCAiugAwIBAgIRAIchZfw0tuX7qK3Vs3BftTowCgYIKoZIzj0EAwMwTzEL
+MAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNo
+IEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDIwHhcNMjYwNTEzMDAwMDAwWhcN
+MzIwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsGA1UEChMESVNSRzEQMA4G
+A1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDwS/6vhrcVqcbBo
++wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7XyFjWsPYhIPt/wzOqxTd2
+b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW87j77GaOB6zCB6DAOBgNV
+HQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQUo8gmWo6hTNA1Y/ybI8g6rlbzT1YwHwYDVR0jBBgwFoAUfEKW
+rt5LSDv6kviejM9ti6lyN5UwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZo
+dHRwOi8veDIuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1Ud
+HwQgMB4wHKAaoBiGFmh0dHA6Ly94Mi5jLmxlbmNyLm9yZy8wCgYIKoZIzj0EAwMD
+aQAwZgIxAMU19WCtmxVND8UHBZRoma49Z7jPs64Dma0eTu1OChVbB/2J7GV3nvYK
+Ax54uk1G9QIxAO0miLVJu8PLNiXXXkiE/gsK3CTRTF/aeo4bMX42Zw40csRU6AC2
+6hSW1/IWaas6dg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
 MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
-Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa
-Fw0yNzAzMTIyMzU5NTlaMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF
-bmNyeXB0MQswCQYDVQQDEwJFODB2MBAGByqGSM49AgEGBSuBBAAiA2IABNFl8l7c
-S7QMApzSsvru6WyrOq44ofTUOTIzxULUzDMMNMchIJBwXOhiLxxxs0LXeb5GDcHb
-R6EToMffgSZjO9SNHfY9gjMy9vQr5/WWOrQTZxh7az6NSNnq3u2ubT6HTKOB+DCB
-9TAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMB
-MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFI8NE6L2Ln7RUGwzGDhdWY4j
-cpHKMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEB
-BCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzATBgNVHSAE
-DDAKMAgGBmeBDAECATAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5j
-ci5vcmcvMA0GCSqGSIb3DQEBCwUAA4ICAQBnE0hGINKsCYWi0Xx1ygxD5qihEjZ0
-RI3tTZz1wuATH3ZwYPIp97kWEayanD1j0cDhIYzy4CkDo2jB8D5t0a6zZWzlr98d
-AQFNh8uKJkIHdLShy+nUyeZxc5bNeMp1Lu0gSzE4McqfmNMvIpeiwWSYO9w82Ob8
-otvXcO2JUYi3svHIWRm3+707DUbL51XMcY2iZdlCq4Wa9nbuk3WTU4gr6LY8MzVA
-aDQG2+4U3eJ6qUF10bBnR1uuVyDYs9RhrwucRVnfuDj29CMLTsplM5f5wSV5hUpm
-Uwp/vV7M4w4aGunt74koX71n4EdagCsL/Yk5+mAQU0+tue0JOfAV/R6t1k+Xk9s2
-HMQFeoxppfzAVC04FdG9M+AC2JWxmFSt6BCuh3CEey3fE52Qrj9YM75rtvIjsm/1
-Hl+u//Wqxnu1ZQ4jpa+VpuZiGOlWrqSP9eogdOhCGisnyewWJwRQOqK16wiGyZeR
-xs/Bekw65vwSIaVkBruPiTfMOo0Zh4gVa8/qJgMbJbyrwwG97z/PRgmLKCDl8z3d
-tA0Z7qq7fta0Gl24uyuB05dqI5J1LvAzKuWdIjT1tP8qCoxSE/xpix8hX2dt3h+/
-jujUgFPFZ0EVZ0xSyBNRF3MboGZnYXFUxpNjTWPKpagDHJQmqrAcDmWJnMsFY3jS
-u1igv3OefnWjSQ==
+Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
+Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
+dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
+ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
+AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
+BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
+5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
+Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
+MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
+ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
+/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
+shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
+2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
+IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
+/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
+upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
+MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
+pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
+cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
+TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
 -----END CERTIFICATE-----

package/lib/certs/privkey.pem

@@ -1,5 +1,5 @@
 -----BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgtwBpQgcr1N5kEPEv
-Rz5JCBMpDQHD8U44HlzB9bLvQAihRANCAARIQA9YbakYPJ+3r35QWdV+1GgnqgRn
-LxvzDbZQCndVVX1Rhbmp8lI5LFffvkdRLii4RDzN5aC/9xs/PlxHsBsO
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgeObHdfttml/RvJo1
+pfW5sNawWozxsJYt7wLg6CpXM8KhRANCAASrxxs5PE+8vMltWI5D+dynbZexsgeg
+G4LmDP2+ZRt4OIWJA4e8qR39LP0W8IRtvhpjM0ifyImZOFfgxX/NgtCB
 -----END PRIVATE KEY-----

package/lib/clay-studio-cert.js

@@ -0,0 +1,112 @@
+// Runtime fetch of the *.d.clay.studio wildcard certificate.
+//
+// Clay serves browser-trusted HTTPS for local instances via a Let's Encrypt
+// wildcard cert for *.d.clay.studio. Historically that cert was baked into the
+// npm package (lib/certs/), so every ~90 days the shipped copy expired and all
+// installed clients silently dropped to HTTP until a new release. This module
+// fetches the CURRENT cert from a small endpoint (served off the same VM that
+// auto-renews it) and caches it under ~/.clay/certs, decoupling cert freshness
+// from npm releases. The baked cert remains a fallback for offline starts.
+//
+// The wildcard private key is public by design: every client needs it to
+// terminate TLS for its own <dashed-ip>.d.clay.studio hostname. This is the
+// same trade-off sslip.io-style zero-config HTTPS already accepts, so fetching
+// it at runtime exposes nothing that the npm tarball did not already.
+
+var fs = require("fs");
+var path = require("path");
+var https = require("https");
+var { execFileSync } = require("child_process");
+var { REAL_HOME } = require("./config");
+
+var DEFAULT_URL = "https://cert.d.clay.studio/clay-cert.json";
+var EXPIRY_SKEW_MS = 7 * 24 * 60 * 60 * 1000;
+
+function certUrl() {
+  return process.env.CLAY_CERT_URL || DEFAULT_URL;
+}
+
+function cacheDir() {
+  var home = process.env.CLAY_HOME || process.env.CLAUDE_RELAY_HOME || path.join(REAL_HOME, ".clay");
+  return path.join(home, "certs");
+}
+
+function fullchainPath() { return path.join(cacheDir(), "clay-studio-fullchain.pem"); }
+function privkeyPath() { return path.join(cacheDir(), "clay-studio-privkey.pem"); }
+
+// notAfter (ms) of a PEM file, or 0 if it can't be read.
+function certExpiryMs(certPath) {
+  try {
+    var out = execFileSync("openssl", ["x509", "-in", certPath, "-noout", "-enddate"], { encoding: "utf8" });
+    var m = out.match(/notAfter=(.+)/);
+    if (m) return new Date(m[1]).getTime();
+  } catch (e) {}
+  return 0;
+}
+
+// Returns { key, cert } cached file paths if a previously-fetched cert exists
+// and is not expiring within 7 days; otherwise null. Synchronous.
+function cachedCertFiles() {
+  var cert = fullchainPath();
+  var key = privkeyPath();
+  if (!fs.existsSync(cert) || !fs.existsSync(key)) return null;
+  var expiry = certExpiryMs(cert);
+  if (expiry && expiry - Date.now() < EXPIRY_SKEW_MS) return null;
+  return { key: key, cert: cert };
+}
+
+function isPem(s) {
+  return typeof s === "string" && s.indexOf("-----BEGIN") !== -1;
+}
+
+// Best-effort fetch of the current cert from the endpoint, written atomically
+// to the cache. Resolves true on success, false on any failure. Never rejects,
+// so callers can `await` it unconditionally on startup.
+function refreshCache(timeoutMs) {
+  return new Promise(function (resolve) {
+    var done = false;
+    function finish(ok) { if (!done) { done = true; resolve(ok); } }
+    var req;
+    try {
+      req = https.get(certUrl(), { timeout: timeoutMs || 5000 }, function (res) {
+        if (res.statusCode !== 200) { res.resume(); return finish(false); }
+        var body = "";
+        res.setEncoding("utf8");
+        res.on("data", function (c) {
+          body += c;
+          if (body.length > 1024 * 1024) { req.destroy(); finish(false); }
+        });
+        res.on("end", function () {
+          try {
+            var obj = JSON.parse(body);
+            if (!isPem(obj.fullchain) || !isPem(obj.privkey)) return finish(false);
+            var dir = cacheDir();
+            fs.mkdirSync(dir, { recursive: true });
+            var ctmp = fullchainPath() + ".tmp";
+            var ktmp = privkeyPath() + ".tmp";
+            fs.writeFileSync(ctmp, obj.fullchain);
+            fs.writeFileSync(ktmp, obj.privkey);
+            try { fs.chmodSync(ktmp, 0o600); } catch (e) {}
+            // Don't overwrite a good cache with a near-expired cert.
+            var expiry = certExpiryMs(ctmp);
+            if (expiry && expiry - Date.now() < EXPIRY_SKEW_MS) {
+              try { fs.unlinkSync(ctmp); fs.unlinkSync(ktmp); } catch (e) {}
+              return finish(false);
+            }
+            fs.renameSync(ctmp, fullchainPath());
+            fs.renameSync(ktmp, privkeyPath());
+            finish(true);
+          } catch (e) { finish(false); }
+        });
+      });
+      req.on("timeout", function () { req.destroy(); finish(false); });
+      req.on("error", function () { finish(false); });
+    } catch (e) { finish(false); }
+  });
+}
+
+module.exports = {
+  certUrl: certUrl,
+  cachedCertFiles: cachedCertFiles,
+  refreshCache: refreshCache,
+};

package/lib/daemon.js

@@ -78,8 +78,17 @@ if (config.tls) {
   var userKeyPath = path.join(certDir, "key.pem");
   var userCertPath = path.join(certDir, "cert.pem");
 
+  // Cert fetched at runtime from the clay.studio endpoint (always current),
+  // cached by the CLI before forking us. Prefer it over the baked copy.
+  var fetched = null;
+  try { fetched = require("./clay-studio-cert").cachedCertFiles(); } catch (e) {}
+
   var keyPath, certPath;
-  if (config.builtinCert !== false && fs.existsSync(builtinKeyPath) && fs.existsSync(builtinCertPath)) {
+  if (config.builtinCert !== false && fetched) {
+    keyPath = fetched.key;
+    certPath = fetched.cert;
+    config.builtinCert = true;
+  } else if (config.builtinCert !== false && fs.existsSync(builtinKeyPath) && fs.existsSync(builtinCertPath)) {
     keyPath = builtinKeyPath;
     certPath = builtinCertPath;
     config.builtinCert = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.42.0",
+  "version": "2.43.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",