clay-server 2.46.0-beta.1 → 2.47.0-beta.1

package/bin/cli.js

@@ -1359,24 +1359,16 @@ function setup(callback) {
           }
           port = p;
           log(sym.bar);
-          askMode();
+          // No "single vs multi" question anymore: every deploy runs in the
+          // (general) multi-user model. Solo users get an auto-provisioned
+          // default admin with no PIN and no login wall. OS-level user
+          // isolation stays an opt-in, offered here on Linux and toggleable
+          // later; everything else is just multi-user.
+          askOsUsers("multi");
         });
       });
     }
 
-    function askMode() {
-      promptSelect("How will you use Clay?", [
-        { label: "Just me (single user)", value: "single" },
-        { label: "Multiple users", value: "multi" },
-      ], function (mode) {
-        if (mode === "single") {
-          finishSetup(mode, false);
-        } else {
-          askOsUsers(mode);
-        }
-      });
-    }
-
     function askOsUsers(mode) {
       // Only offer OS user isolation on Linux
       if (process.platform !== "linux") {
@@ -1554,7 +1546,7 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
     keepAwake: keepAwake,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
     osUsers: wantOsUsers || osUsersMode,
-    mode: mode || "single",
+    mode: mode || "multi",
     setupCompleted: true,
     projects: allProjects,
   });
@@ -1729,7 +1721,7 @@ async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
     debug: true,
     keepAwake: keepAwake || false,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
-    mode: mode || "single",
+    mode: mode || "multi",
     setupCompleted: true,
     projects: allProjects,
     osUsers: wantOsUsers || (prevDevConfig ? (prevDevConfig.osUsers || false) : false),
@@ -2667,7 +2659,7 @@ var currentVersion = require("../package.json").version;
       });
     } else {
       // Reuse existing config (repeat run)
-      await devMode(devConfig.mode || "single", devConfig.keepAwake || false, devConfig.pinHash || null, devConfig.osUsers || false);
+      await devMode(devConfig.mode || "multi", devConfig.keepAwake || false, devConfig.pinHash || null, devConfig.osUsers || false);
     }
     return;
   }
@@ -2767,7 +2759,7 @@ var currentVersion = require("../package.json").version;
 
     if (isRepeatRun || autoYes) {
       // Repeat run or --yes: skip wizard, reuse saved config
-      var savedMode = (savedConfig && savedConfig.mode) || "single";
+      var savedMode = (savedConfig && savedConfig.mode) || "multi";
       var savedKeepAwake = (savedConfig && savedConfig.keepAwake) || false;
       var savedOsUsers = (savedConfig && savedConfig.osUsers) || false;
 

package/lib/daemon.js

@@ -52,6 +52,17 @@ console.log("[daemon] Users: " + usersModule.USERS_FILE);
 if (process.env.SUDO_USER) console.log("[daemon] SUDO_USER: " + process.env.SUDO_USER);
 console.log("[daemon] UID: " + (typeof process.getuid === "function" ? process.getuid() : "N/A"));
 
+// --- Ensure the multi-user model (there is no single-user runtime anymore):
+// migrate a legacy single-user deploy, or provision a default admin on a fresh
+// one. One-time, idempotent, best-effort. Runs before projects/mates/sessions
+// load so the flip and on-disk backfill are in effect for the rest of boot. ---
+try {
+  require("./migrate-single-user").ensureMultiUser();
+  config = loadConfig(); // refresh in-memory config to pick up the migration marker
+} catch (e) {
+  console.error("[daemon] ensureMultiUser threw (continuing):", e && e.message);
+}
+
 // --- OS users mode: check required system dependencies ---
 // Supplementary-group inheritance (issue #367): default on so sessions behave
 // like a normal login; operators can disable via config / the settings toggle.

package/lib/migrate-single-user.js

@@ -0,0 +1,286 @@
+// One-time migration: fold a legacy single-user deploy into the multi-user
+// model by auto-provisioning one "admin" user that inherits the single-user
+// PIN, profile, and settings. After this, the app is always internally
+// multi-user; a solo deploy is just a one-user multi-user deploy (with the
+// solo auto-login safety net so there's no login wall when no PIN was set).
+//
+// Design goals:
+//   - Seamless: existing users upgrade and keep working with no manual steps.
+//     Had a PIN -> same PIN still logs in. Had none -> no login wall.
+//   - Safe: backs up state first, tolerates partial failure (best-effort per
+//     step), and is a no-op on fresh installs and already-multi-user deploys.
+//   - Idempotent: a marker in daemon config prevents re-running.
+//
+// NOTE: this touches on-disk state (users.json, daemon.json, profile.json,
+// mates/). It runs once at daemon boot, before the server starts listening.
+
+var fs = require("fs");
+var path = require("path");
+var config = require("./config");
+var users = require("./users");
+
+var SETTING_KEYS = [
+  "chatLayout",
+  "autoContinueOnRateLimit",
+  "matesEnabled",
+  "terminalFont",
+  "deletedBuiltinKeys",
+  "mateOnboardingShown",
+];
+
+function backupFile(filePath, stamp) {
+  try {
+    if (!fs.existsSync(filePath)) return;
+    var bak = filePath + ".pre-migrate-" + stamp + ".bak";
+    if (fs.existsSync(bak)) return; // don't clobber an existing backup
+    fs.copyFileSync(filePath, bak);
+  } catch (e) {
+    console.error("[migrate] backup failed for " + filePath + ": " + (e.message || e));
+  }
+}
+
+// Move legacy flat mates (CONFIG_DIR/mates/*) under the per-user directory
+// (CONFIG_DIR/mates/<userId>/). Best-effort; never fatal. Mates data is
+// preserved on disk regardless.
+function migrateMatesToUser(userId) {
+  try {
+    var matesRoot = path.join(config.CONFIG_DIR, "mates");
+    if (!fs.existsSync(matesRoot)) return;
+    var userDir = path.join(matesRoot, userId);
+    fs.mkdirSync(userDir, { recursive: true });
+    var entries = fs.readdirSync(matesRoot);
+    for (var i = 0; i < entries.length; i++) {
+      var name = entries[i];
+      // Skip per-user dirs (userId-shaped) and our target dir.
+      if (name === userId) continue;
+      // Only move legacy flat artifacts: mates.json and mate_* directories.
+      var isLegacy = name === "mates.json" || name.indexOf("mate_") === 0;
+      if (!isLegacy) continue;
+      var src = path.join(matesRoot, name);
+      var dst = path.join(userDir, name);
+      if (fs.existsSync(dst)) continue; // don't clobber freshly-seeded builtins
+      try { fs.renameSync(src, dst); }
+      catch (e) { console.error("[migrate] mates move skipped for " + name + ": " + (e.message || e)); }
+    }
+  } catch (e) {
+    console.error("[migrate] mates migration failed (non-fatal): " + (e.message || e));
+  }
+}
+
+// Backfill ownerId onto legacy sessions (created before ownership existed) so
+// they belong to the migrated user. Walks CONFIG_DIR/sessions/**/*.jsonl and
+// patches the first "meta" line in place. Best-effort per file.
+function backfillSessionOwners(userId) {
+  var count = 0;
+  try {
+    var root = path.join(config.CONFIG_DIR, "sessions");
+    if (!fs.existsSync(root)) return 0;
+    var stack = [root];
+    while (stack.length > 0) {
+      var dir = stack.pop();
+      var entries;
+      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { continue; }
+      for (var i = 0; i < entries.length; i++) {
+        var ent = entries[i];
+        var full = path.join(dir, ent.name);
+        if (ent.isDirectory()) { stack.push(full); continue; }
+        if (!ent.name.endsWith(".jsonl")) continue;
+        try {
+          var content = fs.readFileSync(full, "utf8");
+          var nl = content.indexOf("\n");
+          var firstLine = nl === -1 ? content : content.slice(0, nl);
+          var rest = nl === -1 ? "" : content.slice(nl); // includes leading \n
+          var meta;
+          try { meta = JSON.parse(firstLine); } catch (e) { continue; }
+          if (!meta || meta.type !== "meta") continue;
+          if (meta.ownerId) continue; // already owned
+          meta.ownerId = userId;
+          var tmp = full + ".tmp." + Date.now();
+          fs.writeFileSync(tmp, JSON.stringify(meta) + rest);
+          fs.renameSync(tmp, full);
+          count++;
+        } catch (e) { /* skip this file */ }
+      }
+    }
+  } catch (e) {
+    console.error("[migrate] session ownerId backfill failed (non-fatal): " + (e.message || e));
+  }
+  return count;
+}
+
+function readProfile() {
+  try {
+    var p = path.join(config.CONFIG_DIR, "profile.json");
+    if (!fs.existsSync(p)) return null;
+    var raw = fs.readFileSync(p, "utf8");
+    var obj = JSON.parse(raw);
+    return (obj && typeof obj === "object") ? obj : null;
+  } catch (e) { return null; }
+}
+
+// Returns { migrated: true, userId } on success, or { skipped: <reason> }.
+function migrateSingleUserToMulti() {
+  try {
+    // Guard 1: already multi-user -> nothing to do.
+    if (users.isMultiUser()) return { skipped: "already-multi-user" };
+
+    // Guard 2: users already exist (partial prior run) -> don't double-create.
+    var existing = users.getAllUsers();
+    if (existing && existing.length > 0) return { skipped: "users-exist" };
+
+    var cfg = config.loadConfig() || {};
+
+    // Guard 3: idempotency marker.
+    if (cfg.singleUserMigratedAt) return { skipped: "already-migrated" };
+
+    // Guard 4: only migrate deploys that show prior single-user use. A pristine
+    // fresh install (no PIN, no settings, no profile) is left for the later
+    // default-flip phase, so this migration is strictly an upgrade path.
+    var profile = readProfile();
+    var hasSettings = SETTING_KEYS.some(function (k) { return cfg[k] !== undefined; });
+    var hasPin = !!cfg.pinHash;
+    if (!profile && !hasSettings && !hasPin) return { skipped: "fresh-install" };
+
+    var stamp = String(Date.now());
+    console.log("[migrate] Legacy single-user deploy detected; migrating to multi-user (stamp=" + stamp + ")");
+
+    // --- Backup before touching anything ---
+    backupFile(config.configPath(), stamp);
+    // users.json / auth-tokens live in CONFIG_DIR; back them up if present.
+    backupFile(path.join(config.CONFIG_DIR, "users.json"), stamp);
+    backupFile(path.join(config.CONFIG_DIR, "profile.json"), stamp);
+
+    // --- Flip to multi-user, then provision the sole admin ---
+    // Flip first so createUser's built-in mate seeding writes to the per-user
+    // mates path (CONFIG_DIR/mates/<userId>/), not the flat legacy path.
+    users.enableMultiUser();
+
+    var displayName = (profile && profile.name) ? String(profile.name) : "Admin";
+    var created = users.createUserWithoutPin({
+      username: "admin",
+      displayName: displayName,
+      role: "admin",
+      profile: profile || undefined,
+    });
+    if (!created || !created.user) {
+      console.error("[migrate] Failed to create admin user: " + (created && created.error));
+      // Roll the flag back so we don't leave a userless multi-user deploy.
+      try { users.disableMultiUser(); } catch (e) {}
+      return { skipped: "create-failed" };
+    }
+    var userId = created.user.id;
+
+    // --- Carry over the PIN hash directly (preserve the existing credential;
+    // we have the hash, not the raw PIN, so we can't go through updateUserPin) ---
+    if (hasPin) {
+      try {
+        var data = users.loadUsers();
+        for (var i = 0; i < data.users.length; i++) {
+          if (data.users[i].id === userId) { data.users[i].pinHash = cfg.pinHash; break; }
+        }
+        users.saveUsers(data);
+      } catch (e) {
+        console.error("[migrate] PIN carry-over failed (user will have no PIN): " + (e.message || e));
+      }
+    }
+
+    // --- Carry over settings ---
+    try {
+      if (cfg.chatLayout !== undefined && users.setChatLayout) users.setChatLayout(userId, cfg.chatLayout);
+      if (cfg.autoContinueOnRateLimit !== undefined && users.setAutoContinue) users.setAutoContinue(userId, cfg.autoContinueOnRateLimit);
+      if (cfg.matesEnabled !== undefined && users.setMatesEnabled) users.setMatesEnabled(userId, cfg.matesEnabled);
+      if (cfg.terminalFont && users.setTerminalFont) {
+        users.setTerminalFont(userId, cfg.terminalFont.family, cfg.terminalFont.size);
+      }
+      // Fields without a dedicated setter: write directly.
+      if (cfg.deletedBuiltinKeys !== undefined || cfg.mateOnboardingShown !== undefined) {
+        var d2 = users.loadUsers();
+        for (var j = 0; j < d2.users.length; j++) {
+          if (d2.users[j].id === userId) {
+            if (cfg.deletedBuiltinKeys !== undefined) d2.users[j].deletedBuiltinKeys = cfg.deletedBuiltinKeys;
+            if (cfg.mateOnboardingShown !== undefined) d2.users[j].mateOnboardingShown = cfg.mateOnboardingShown;
+            break;
+          }
+        }
+        users.saveUsers(d2);
+      }
+    } catch (e) {
+      console.error("[migrate] settings carry-over failed (non-fatal): " + (e.message || e));
+    }
+
+    // --- Move legacy flat mates under the new user ---
+    migrateMatesToUser(userId);
+
+    // --- Backfill session ownership so legacy sessions belong to the user ---
+    var backfilled = backfillSessionOwners(userId);
+    if (backfilled > 0) console.log("[migrate] Backfilled ownerId on " + backfilled + " legacy session(s)");
+
+    // --- Mark done (keep the old daemon-config keys for now; a later phase
+    // removes the dual settings path). ---
+    try {
+      var freshCfg = config.loadConfig() || {};
+      freshCfg.singleUserMigratedAt = Date.now();
+      freshCfg.singleUserMigratedUserId = userId;
+      config.saveConfig(freshCfg);
+    } catch (e) {
+      console.error("[migrate] Failed to write migration marker: " + (e.message || e));
+    }
+
+    console.log("[migrate] Single-user -> multi-user migration complete. admin userId=" + userId + (hasPin ? " (PIN preserved)" : " (no PIN; solo auto-login)"));
+    return { migrated: true, userId: userId };
+  } catch (e) {
+    console.error("[migrate] Single-user migration aborted (non-fatal): " + (e.message || e));
+    return { skipped: "error", error: e.message || String(e) };
+  }
+}
+
+// Guarantee the app is in the multi-user model with at least one user, so the
+// single-user runtime never exists. Called at daemon boot:
+//   - already multi-user with users -> nothing to do
+//   - legacy single-user with data   -> migrate it (preserves PIN/settings)
+//   - fresh/empty                    -> provision one no-PIN "admin"
+//                                       (solo auto-login: no login wall)
+// OS-user isolation stays an orthogonal, settings/flag-driven toggle.
+function ensureMultiUser() {
+  try {
+    if (users.isMultiUser()) {
+      var have = users.getAllUsers();
+      if (have && have.length > 0) return { skipped: "ready" };
+    }
+
+    // Try the legacy single-user migration first (handles PIN/settings/mates/
+    // session carry-over for existing deploys).
+    var mig = migrateSingleUserToMulti();
+    if (mig && mig.migrated) return mig;
+
+    // Fresh or empty deploy: provision a default admin so we're multi-user with
+    // one user. No PIN -> the phase-1 solo auto-login skips the login wall.
+    var existing = users.getAllUsers();
+    if (!existing || existing.length === 0) {
+      if (!users.isMultiUser()) users.enableMultiUser();
+      var created = users.createUserWithoutPin({
+        username: "admin",
+        displayName: "Admin",
+        role: "admin",
+      });
+      if (!created || !created.user) {
+        console.error("[migrate] Failed to provision default admin: " + (created && created.error));
+        return { skipped: "provision-failed" };
+      }
+      console.log("[migrate] Provisioned default admin (no PIN; solo auto-login). userId=" + created.user.id);
+      return { provisioned: true, userId: created.user.id };
+    }
+
+    // Users exist but flag wasn't set (shouldn't normally happen) -> flip it.
+    if (!users.isMultiUser()) users.enableMultiUser();
+    return { skipped: "flag-fixed" };
+  } catch (e) {
+    console.error("[migrate] ensureMultiUser failed (non-fatal): " + (e.message || e));
+    return { skipped: "error", error: e.message || String(e) };
+  }
+}
+
+module.exports = {
+  migrateSingleUserToMulti: migrateSingleUserToMulti,
+  ensureMultiUser: ensureMultiUser,
+};

package/lib/public/modules/app-panels.js

@@ -108,6 +108,7 @@ var CODEX_WEBSEARCH_OPTIONS = [
 var KNOWN_CONTEXT_WINDOWS = {
   "opus-4-6": 1000000,
   "claude-sonnet-4": 1000000,
+  "gpt-5.6": 272000,
   "gpt-5.5": 1048576,
   "gpt-5.4": 1048576,
   "gpt-5.3": 1048576,

package/lib/server-auth.js

@@ -102,11 +102,20 @@ function attachAuth(ctx) {
   function getMultiUserFromReq(req) {
     var cookies = parseCookies(req);
     var token = cookies[MULTI_USER_COOKIE];
-    if (!token) return null;
-    var userId = multiUserTokens[token];
-    if (!userId) return null;
-    var user = users.findUserById(userId);
-    return user || null;
+    if (token) {
+      var userId = multiUserTokens[token];
+      if (userId) {
+        var user = users.findUserById(userId);
+        if (user) return user;
+      }
+    }
+    // Solo auto-login: exactly one user with no PIN => frictionless access, no
+    // login wall. Mirrors the old single-user onramp once single-user mode is
+    // absorbed into multi-user. Disabled the moment a PIN is set or a second
+    // user is added (then the normal token/login flow applies).
+    var solo = users.getSoloNoPinUser();
+    if (solo) return solo;
+    return null;
   }
 
   function isMultiUserAuthed(req) {

package/lib/users.js

@@ -165,6 +165,19 @@ function getAllUsers() {
   });
 }
 
+// Solo frictionless access: exactly one user with no PIN. Returns the full
+// user record (callers read id/role/etc.) or null. Used to skip the login wall
+// so an absorbed single-user deploy stays zero-friction; auto-disables the
+// moment a PIN is set or a second user is added.
+function getSoloNoPinUser() {
+  if (!isMultiUser()) return null;
+  var data = loadUsers();
+  if (!data.users || data.users.length !== 1) return null;
+  var u = data.users[0];
+  if (u.pinHash) return null;
+  return u;
+}
+
 function getOtherUsers(excludeUserId) {
   return getAllUsers().filter(function (u) {
     return u.id !== excludeUserId;
@@ -451,6 +464,7 @@ module.exports = {
   findUserByEmail: findUserByEmail,
   authenticateUser: authenticateUser,
   getAllUsers: getAllUsers,
+  getSoloNoPinUser: getSoloNoPinUser,
   removeUser: removeUser,
   updateUserProfile: updateUserProfile,
   updateUserPin: updateUserPin,

package/lib/yoke/adapters/codex.js

@@ -620,7 +620,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
     done: false,
     aborted: false,
     loopStarted: false,
-    model: queryOpts.model || "gpt-5.5",
+    model: queryOpts.model || "gpt-5.6-terra",
     // Track incremental text deltas
     textBlocks: {},     // itemId -> true (text_start sent)
     textLengths: {},    // itemId -> last sent length
@@ -865,7 +865,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
 
       // Start or resume thread
       var threadParams = {
-        model: queryOpts.model || "gpt-5.5",
+        model: queryOpts.model || "gpt-5.6-terra",
         sandbox: queryOpts.sandboxMode || "workspace-write",
         approvalPolicy: queryOpts.approvalPolicy || "on-failure",
         cwd: queryOpts.cwd,
@@ -1086,6 +1086,9 @@ function createCodexAdapter(opts) {
   // slow/failed `initialize` leaves the picker empty and the chip shows the
   // previous vendor's model.
   var CODEX_MODELS = [
+    "gpt-5.6-terra",
+    "gpt-5.6-sol",
+    "gpt-5.6-luna",
     "gpt-5.5",
     "gpt-5.4",
     "gpt-5.4-mini",
@@ -1131,7 +1134,7 @@ function createCodexAdapter(opts) {
   function buildReadyResponse(skillNames) {
     return {
       models: _cachedModels,
-      defaultModel: "gpt-5.5",
+      defaultModel: "gpt-5.6-terra",
       skills: skillNames || [],
       slashCommands: skillNames || [],
       fastModeState: null,
@@ -1428,7 +1431,7 @@ function createCodexAdapter(opts) {
         throw new Error("[yoke/codex] Adapter not initialized. Call init() first.");
       }
 
-      var model = queryOpts.model || "gpt-5.5";
+      var model = queryOpts.model || "gpt-5.6-terra";
       var ac = queryOpts.abortController || new AbortController();
       var activeEntry = {
         abort: function() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.46.0-beta.1",
+  "version": "2.47.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",