clay-server 2.46.0 → 2.47.0-beta.2

package/bin/cli.js

@@ -1359,24 +1359,16 @@ function setup(callback) {
           }
           port = p;
           log(sym.bar);
-          askMode();
+          // No "single vs multi" question anymore: every deploy runs in the
+          // (general) multi-user model. Solo users get an auto-provisioned
+          // default admin with no PIN and no login wall. OS-level user
+          // isolation stays an opt-in, offered here on Linux and toggleable
+          // later; everything else is just multi-user.
+          askOsUsers("multi");
         });
       });
     }
 
-    function askMode() {
-      promptSelect("How will you use Clay?", [
-        { label: "Just me (single user)", value: "single" },
-        { label: "Multiple users", value: "multi" },
-      ], function (mode) {
-        if (mode === "single") {
-          finishSetup(mode, false);
-        } else {
-          askOsUsers(mode);
-        }
-      });
-    }
-
     function askOsUsers(mode) {
       // Only offer OS user isolation on Linux
       if (process.platform !== "linux") {
@@ -1554,7 +1546,7 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
     keepAwake: keepAwake,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
     osUsers: wantOsUsers || osUsersMode,
-    mode: mode || "single",
+    mode: mode || "multi",
     setupCompleted: true,
     projects: allProjects,
   });
@@ -1729,7 +1721,7 @@ async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
     debug: true,
     keepAwake: keepAwake || false,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
-    mode: mode || "single",
+    mode: mode || "multi",
     setupCompleted: true,
     projects: allProjects,
     osUsers: wantOsUsers || (prevDevConfig ? (prevDevConfig.osUsers || false) : false),
@@ -2667,7 +2659,7 @@ var currentVersion = require("../package.json").version;
       });
     } else {
       // Reuse existing config (repeat run)
-      await devMode(devConfig.mode || "single", devConfig.keepAwake || false, devConfig.pinHash || null, devConfig.osUsers || false);
+      await devMode(devConfig.mode || "multi", devConfig.keepAwake || false, devConfig.pinHash || null, devConfig.osUsers || false);
     }
     return;
   }
@@ -2767,7 +2759,7 @@ var currentVersion = require("../package.json").version;
 
     if (isRepeatRun || autoYes) {
       // Repeat run or --yes: skip wizard, reuse saved config
-      var savedMode = (savedConfig && savedConfig.mode) || "single";
+      var savedMode = (savedConfig && savedConfig.mode) || "multi";
       var savedKeepAwake = (savedConfig && savedConfig.keepAwake) || false;
       var savedOsUsers = (savedConfig && savedConfig.osUsers) || false;
 

package/lib/daemon.js

@@ -52,6 +52,17 @@ console.log("[daemon] Users: " + usersModule.USERS_FILE);
 if (process.env.SUDO_USER) console.log("[daemon] SUDO_USER: " + process.env.SUDO_USER);
 console.log("[daemon] UID: " + (typeof process.getuid === "function" ? process.getuid() : "N/A"));
 
+// --- Ensure the multi-user model (there is no single-user runtime anymore):
+// migrate a legacy single-user deploy, or provision a default admin on a fresh
+// one. One-time, idempotent, best-effort. Runs before projects/mates/sessions
+// load so the flip and on-disk backfill are in effect for the rest of boot. ---
+try {
+  require("./migrate-single-user").ensureMultiUser();
+  config = loadConfig(); // refresh in-memory config to pick up the migration marker
+} catch (e) {
+  console.error("[daemon] ensureMultiUser threw (continuing):", e && e.message);
+}
+
 // --- OS users mode: check required system dependencies ---
 // Supplementary-group inheritance (issue #367): default on so sessions behave
 // like a normal login; operators can disable via config / the settings toggle.
@@ -637,6 +648,29 @@ var relay = createServer({
     }
     return { ok: false, error: "Project not found" };
   },
+  onGetProjectLastVendor: function (slug) {
+    for (var i = 0; i < config.projects.length; i++) {
+      if (config.projects[i].slug === slug) {
+        return { vendor: config.projects[i].lastVendor || null };
+      }
+    }
+    return { vendor: null };
+  },
+  onSetProjectLastVendor: function (slug, vendor) {
+    for (var i = 0; i < config.projects.length; i++) {
+      if (config.projects[i].slug === slug) {
+        if (config.projects[i].lastVendor === vendor) return { ok: true };
+        if (vendor) {
+          config.projects[i].lastVendor = vendor;
+        } else {
+          delete config.projects[i].lastVendor;
+        }
+        saveConfig(config);
+        return { ok: true };
+      }
+    }
+    return { ok: false, error: "Project not found" };
+  },
   onGetProjectMcpServers: function (slug) {
     for (var i = 0; i < config.projects.length; i++) {
       if (config.projects[i].slug === slug) {
@@ -957,21 +991,28 @@ var relay = createServer({
   },
 });
 
-var IDLE_MS = Number(process.env.CLAY_CODEX_IDLE_MS) || 5 * 60 * 1000;
-var REAP_MS = Number(process.env.CLAY_CODEX_REAPER_MS) || 60 * 1000;
+// Reclaim idle out-of-process agent runtimes. Any adapter that owns a child
+// process may implement the optional shutdownIfIdle(ms); adapters without one
+// (Claude, which runs in-process or under sdk-worker) are simply skipped.
+// The CLAY_CODEX_* names are kept as aliases for backwards compatibility.
+var IDLE_MS = Number(process.env.CLAY_ADAPTER_IDLE_MS) || Number(process.env.CLAY_CODEX_IDLE_MS) || 5 * 60 * 1000;
+var REAP_MS = Number(process.env.CLAY_ADAPTER_REAPER_MS) || Number(process.env.CLAY_CODEX_REAPER_MS) || 60 * 1000;
 var reaperHandle = setInterval(function () {
   if (!relay || typeof relay.forEachProject !== "function") return;
   relay.forEachProject(function (ctx) {
-    try {
-      if (ctx && ctx.adapters && ctx.adapters.codex && typeof ctx.adapters.codex.shutdownIfIdle === "function") {
-        var result = ctx.adapters.codex.shutdownIfIdle(IDLE_MS);
+    if (!ctx || !ctx.adapters) return;
+    Object.keys(ctx.adapters).forEach(function (vendor) {
+      try {
+        var adapter = ctx.adapters[vendor];
+        if (!adapter || typeof adapter.shutdownIfIdle !== "function") return;
+        var result = adapter.shutdownIfIdle(IDLE_MS);
         if (result && typeof result.catch === "function") {
           result.catch(function (e) {
-            console.error("[daemon] Codex idle reclaim failed:", e && e.message ? e.message : e);
+            console.error("[daemon] " + vendor + " idle reclaim failed:", e && e.message ? e.message : e);
           });
         }
-      }
-    } catch (e) {}
+      } catch (e) {}
+    });
   });
 }, REAP_MS);
 if (reaperHandle && typeof reaperHandle.unref === "function") {

package/lib/kiro-defaults.js

@@ -0,0 +1,22 @@
+// Kiro-specific default values. Single source of truth — do not duplicate
+// elsewhere. Consumed by the server-side vendor plumbing and sent to clients
+// via the config state so the UI renders the right controls.
+
+var KIRO_DEFAULTS = {
+  // Kiro CLI 2.18.1 exposes the next-generation agent as the v3 engine. Its
+  // general-purpose mode id is "vibe" (displayed as "Default").
+  engine: "v3",
+  mode: "vibe",
+};
+
+function getKiroConfig(sm) {
+  return {
+    engine: (sm && sm.kiroEngine) || KIRO_DEFAULTS.engine,
+    mode: (sm && sm.kiroMode) || KIRO_DEFAULTS.mode,
+  };
+}
+
+module.exports = {
+  KIRO_DEFAULTS: KIRO_DEFAULTS,
+  getKiroConfig: getKiroConfig,
+};

package/lib/migrate-single-user.js

@@ -0,0 +1,286 @@
+// One-time migration: fold a legacy single-user deploy into the multi-user
+// model by auto-provisioning one "admin" user that inherits the single-user
+// PIN, profile, and settings. After this, the app is always internally
+// multi-user; a solo deploy is just a one-user multi-user deploy (with the
+// solo auto-login safety net so there's no login wall when no PIN was set).
+//
+// Design goals:
+//   - Seamless: existing users upgrade and keep working with no manual steps.
+//     Had a PIN -> same PIN still logs in. Had none -> no login wall.
+//   - Safe: backs up state first, tolerates partial failure (best-effort per
+//     step), and is a no-op on fresh installs and already-multi-user deploys.
+//   - Idempotent: a marker in daemon config prevents re-running.
+//
+// NOTE: this touches on-disk state (users.json, daemon.json, profile.json,
+// mates/). It runs once at daemon boot, before the server starts listening.
+
+var fs = require("fs");
+var path = require("path");
+var config = require("./config");
+var users = require("./users");
+
+var SETTING_KEYS = [
+  "chatLayout",
+  "autoContinueOnRateLimit",
+  "matesEnabled",
+  "terminalFont",
+  "deletedBuiltinKeys",
+  "mateOnboardingShown",
+];
+
+function backupFile(filePath, stamp) {
+  try {
+    if (!fs.existsSync(filePath)) return;
+    var bak = filePath + ".pre-migrate-" + stamp + ".bak";
+    if (fs.existsSync(bak)) return; // don't clobber an existing backup
+    fs.copyFileSync(filePath, bak);
+  } catch (e) {
+    console.error("[migrate] backup failed for " + filePath + ": " + (e.message || e));
+  }
+}
+
+// Move legacy flat mates (CONFIG_DIR/mates/*) under the per-user directory
+// (CONFIG_DIR/mates/<userId>/). Best-effort; never fatal. Mates data is
+// preserved on disk regardless.
+function migrateMatesToUser(userId) {
+  try {
+    var matesRoot = path.join(config.CONFIG_DIR, "mates");
+    if (!fs.existsSync(matesRoot)) return;
+    var userDir = path.join(matesRoot, userId);
+    fs.mkdirSync(userDir, { recursive: true });
+    var entries = fs.readdirSync(matesRoot);
+    for (var i = 0; i < entries.length; i++) {
+      var name = entries[i];
+      // Skip per-user dirs (userId-shaped) and our target dir.
+      if (name === userId) continue;
+      // Only move legacy flat artifacts: mates.json and mate_* directories.
+      var isLegacy = name === "mates.json" || name.indexOf("mate_") === 0;
+      if (!isLegacy) continue;
+      var src = path.join(matesRoot, name);
+      var dst = path.join(userDir, name);
+      if (fs.existsSync(dst)) continue; // don't clobber freshly-seeded builtins
+      try { fs.renameSync(src, dst); }
+      catch (e) { console.error("[migrate] mates move skipped for " + name + ": " + (e.message || e)); }
+    }
+  } catch (e) {
+    console.error("[migrate] mates migration failed (non-fatal): " + (e.message || e));
+  }
+}
+
+// Backfill ownerId onto legacy sessions (created before ownership existed) so
+// they belong to the migrated user. Walks CONFIG_DIR/sessions/**/*.jsonl and
+// patches the first "meta" line in place. Best-effort per file.
+function backfillSessionOwners(userId) {
+  var count = 0;
+  try {
+    var root = path.join(config.CONFIG_DIR, "sessions");
+    if (!fs.existsSync(root)) return 0;
+    var stack = [root];
+    while (stack.length > 0) {
+      var dir = stack.pop();
+      var entries;
+      try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { continue; }
+      for (var i = 0; i < entries.length; i++) {
+        var ent = entries[i];
+        var full = path.join(dir, ent.name);
+        if (ent.isDirectory()) { stack.push(full); continue; }
+        if (!ent.name.endsWith(".jsonl")) continue;
+        try {
+          var content = fs.readFileSync(full, "utf8");
+          var nl = content.indexOf("\n");
+          var firstLine = nl === -1 ? content : content.slice(0, nl);
+          var rest = nl === -1 ? "" : content.slice(nl); // includes leading \n
+          var meta;
+          try { meta = JSON.parse(firstLine); } catch (e) { continue; }
+          if (!meta || meta.type !== "meta") continue;
+          if (meta.ownerId) continue; // already owned
+          meta.ownerId = userId;
+          var tmp = full + ".tmp." + Date.now();
+          fs.writeFileSync(tmp, JSON.stringify(meta) + rest);
+          fs.renameSync(tmp, full);
+          count++;
+        } catch (e) { /* skip this file */ }
+      }
+    }
+  } catch (e) {
+    console.error("[migrate] session ownerId backfill failed (non-fatal): " + (e.message || e));
+  }
+  return count;
+}
+
+function readProfile() {
+  try {
+    var p = path.join(config.CONFIG_DIR, "profile.json");
+    if (!fs.existsSync(p)) return null;
+    var raw = fs.readFileSync(p, "utf8");
+    var obj = JSON.parse(raw);
+    return (obj && typeof obj === "object") ? obj : null;
+  } catch (e) { return null; }
+}
+
+// Returns { migrated: true, userId } on success, or { skipped: <reason> }.
+function migrateSingleUserToMulti() {
+  try {
+    // Guard 1: already multi-user -> nothing to do.
+    if (users.isMultiUser()) return { skipped: "already-multi-user" };
+
+    // Guard 2: users already exist (partial prior run) -> don't double-create.
+    var existing = users.getAllUsers();
+    if (existing && existing.length > 0) return { skipped: "users-exist" };
+
+    var cfg = config.loadConfig() || {};
+
+    // Guard 3: idempotency marker.
+    if (cfg.singleUserMigratedAt) return { skipped: "already-migrated" };
+
+    // Guard 4: only migrate deploys that show prior single-user use. A pristine
+    // fresh install (no PIN, no settings, no profile) is left for the later
+    // default-flip phase, so this migration is strictly an upgrade path.
+    var profile = readProfile();
+    var hasSettings = SETTING_KEYS.some(function (k) { return cfg[k] !== undefined; });
+    var hasPin = !!cfg.pinHash;
+    if (!profile && !hasSettings && !hasPin) return { skipped: "fresh-install" };
+
+    var stamp = String(Date.now());
+    console.log("[migrate] Legacy single-user deploy detected; migrating to multi-user (stamp=" + stamp + ")");
+
+    // --- Backup before touching anything ---
+    backupFile(config.configPath(), stamp);
+    // users.json / auth-tokens live in CONFIG_DIR; back them up if present.
+    backupFile(path.join(config.CONFIG_DIR, "users.json"), stamp);
+    backupFile(path.join(config.CONFIG_DIR, "profile.json"), stamp);
+
+    // --- Flip to multi-user, then provision the sole admin ---
+    // Flip first so createUser's built-in mate seeding writes to the per-user
+    // mates path (CONFIG_DIR/mates/<userId>/), not the flat legacy path.
+    users.enableMultiUser();
+
+    var displayName = (profile && profile.name) ? String(profile.name) : "Admin";
+    var created = users.createUserWithoutPin({
+      username: "admin",
+      displayName: displayName,
+      role: "admin",
+      profile: profile || undefined,
+    });
+    if (!created || !created.user) {
+      console.error("[migrate] Failed to create admin user: " + (created && created.error));
+      // Roll the flag back so we don't leave a userless multi-user deploy.
+      try { users.disableMultiUser(); } catch (e) {}
+      return { skipped: "create-failed" };
+    }
+    var userId = created.user.id;
+
+    // --- Carry over the PIN hash directly (preserve the existing credential;
+    // we have the hash, not the raw PIN, so we can't go through updateUserPin) ---
+    if (hasPin) {
+      try {
+        var data = users.loadUsers();
+        for (var i = 0; i < data.users.length; i++) {
+          if (data.users[i].id === userId) { data.users[i].pinHash = cfg.pinHash; break; }
+        }
+        users.saveUsers(data);
+      } catch (e) {
+        console.error("[migrate] PIN carry-over failed (user will have no PIN): " + (e.message || e));
+      }
+    }
+
+    // --- Carry over settings ---
+    try {
+      if (cfg.chatLayout !== undefined && users.setChatLayout) users.setChatLayout(userId, cfg.chatLayout);
+      if (cfg.autoContinueOnRateLimit !== undefined && users.setAutoContinue) users.setAutoContinue(userId, cfg.autoContinueOnRateLimit);
+      if (cfg.matesEnabled !== undefined && users.setMatesEnabled) users.setMatesEnabled(userId, cfg.matesEnabled);
+      if (cfg.terminalFont && users.setTerminalFont) {
+        users.setTerminalFont(userId, cfg.terminalFont.family, cfg.terminalFont.size);
+      }
+      // Fields without a dedicated setter: write directly.
+      if (cfg.deletedBuiltinKeys !== undefined || cfg.mateOnboardingShown !== undefined) {
+        var d2 = users.loadUsers();
+        for (var j = 0; j < d2.users.length; j++) {
+          if (d2.users[j].id === userId) {
+            if (cfg.deletedBuiltinKeys !== undefined) d2.users[j].deletedBuiltinKeys = cfg.deletedBuiltinKeys;
+            if (cfg.mateOnboardingShown !== undefined) d2.users[j].mateOnboardingShown = cfg.mateOnboardingShown;
+            break;
+          }
+        }
+        users.saveUsers(d2);
+      }
+    } catch (e) {
+      console.error("[migrate] settings carry-over failed (non-fatal): " + (e.message || e));
+    }
+
+    // --- Move legacy flat mates under the new user ---
+    migrateMatesToUser(userId);
+
+    // --- Backfill session ownership so legacy sessions belong to the user ---
+    var backfilled = backfillSessionOwners(userId);
+    if (backfilled > 0) console.log("[migrate] Backfilled ownerId on " + backfilled + " legacy session(s)");
+
+    // --- Mark done (keep the old daemon-config keys for now; a later phase
+    // removes the dual settings path). ---
+    try {
+      var freshCfg = config.loadConfig() || {};
+      freshCfg.singleUserMigratedAt = Date.now();
+      freshCfg.singleUserMigratedUserId = userId;
+      config.saveConfig(freshCfg);
+    } catch (e) {
+      console.error("[migrate] Failed to write migration marker: " + (e.message || e));
+    }
+
+    console.log("[migrate] Single-user -> multi-user migration complete. admin userId=" + userId + (hasPin ? " (PIN preserved)" : " (no PIN; solo auto-login)"));
+    return { migrated: true, userId: userId };
+  } catch (e) {
+    console.error("[migrate] Single-user migration aborted (non-fatal): " + (e.message || e));
+    return { skipped: "error", error: e.message || String(e) };
+  }
+}
+
+// Guarantee the app is in the multi-user model with at least one user, so the
+// single-user runtime never exists. Called at daemon boot:
+//   - already multi-user with users -> nothing to do
+//   - legacy single-user with data   -> migrate it (preserves PIN/settings)
+//   - fresh/empty                    -> provision one no-PIN "admin"
+//                                       (solo auto-login: no login wall)
+// OS-user isolation stays an orthogonal, settings/flag-driven toggle.
+function ensureMultiUser() {
+  try {
+    if (users.isMultiUser()) {
+      var have = users.getAllUsers();
+      if (have && have.length > 0) return { skipped: "ready" };
+    }
+
+    // Try the legacy single-user migration first (handles PIN/settings/mates/
+    // session carry-over for existing deploys).
+    var mig = migrateSingleUserToMulti();
+    if (mig && mig.migrated) return mig;
+
+    // Fresh or empty deploy: provision a default admin so we're multi-user with
+    // one user. No PIN -> the phase-1 solo auto-login skips the login wall.
+    var existing = users.getAllUsers();
+    if (!existing || existing.length === 0) {
+      if (!users.isMultiUser()) users.enableMultiUser();
+      var created = users.createUserWithoutPin({
+        username: "admin",
+        displayName: "Admin",
+        role: "admin",
+      });
+      if (!created || !created.user) {
+        console.error("[migrate] Failed to provision default admin: " + (created && created.error));
+        return { skipped: "provision-failed" };
+      }
+      console.log("[migrate] Provisioned default admin (no PIN; solo auto-login). userId=" + created.user.id);
+      return { provisioned: true, userId: created.user.id };
+    }
+
+    // Users exist but flag wasn't set (shouldn't normally happen) -> flip it.
+    if (!users.isMultiUser()) users.enableMultiUser();
+    return { skipped: "flag-fixed" };
+  } catch (e) {
+    console.error("[migrate] ensureMultiUser failed (non-fatal): " + (e.message || e));
+    return { skipped: "error", error: e.message || String(e) };
+  }
+}
+
+module.exports = {
+  migrateSingleUserToMulti: migrateSingleUserToMulti,
+  ensureMultiUser: ensureMultiUser,
+};

package/lib/project-connection.js

@@ -143,6 +143,7 @@ function attachConnection(ctx) {
       sendTo(ws, { type: "model_info", model: sm.currentModel, models: initialModels, vendor: initialVendor, availableVendors: sm.availableVendors || [], installedVendors: sm.installedVendors || [] });
     }
     sendTo(ws, { type: "config_state", model: sm.currentModel || "", mode: sm.currentPermissionMode || "default", effort: sm.currentEffort || "medium", betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
+    sendTo(ws, { type: "last_vendor", vendor: sm.lastVendor || "" });
     sendTo(ws, Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
     sendTo(ws, { type: "term_list", terminals: tm.list() });
     // Context sources sent after session is resolved (per-session storage)

package/lib/project-notifications.js

@@ -21,7 +21,7 @@ function generateId() {
 var formatters = {
   auth_required: function (data) {
     var vendor = data.vendor || "claude";
-    var title = data.title || ((vendor === "codex" ? "Codex" : "Claude Code") + " is not logged in");
+    var title = data.title || ((vendor === "codex" ? "Codex" : (vendor === "kiro" ? "Kiro CLI" : "Claude Code")) + " is not logged in");
     return {
       type: "auth_required",
       title: title,

package/lib/project-sessions.js

@@ -424,13 +424,13 @@ function attachSessions(ctx) {
       if (ws._clayUser && usersModule.isMultiUser()) sessionOpts.ownerId = ws._clayUser.id;
       if (msg.sessionVisibility) sessionOpts.sessionVisibility = msg.sessionVisibility;
       if (msg.vendor) sessionOpts.vendor = msg.vendor;
-      // Mode resolution: codex sessions are always GUI (no TUI adapter).
+      // Mode resolution: codex and kiro sessions are always GUI (no TUI adapter).
       // Claude sessions honor the explicit msg.mode if provided, otherwise
       // fall back to the user's claudeOpenMode preference. This is what
       // makes the sidebar's "Claude" icon button create the right kind of
       // session without the client needing to know the preference.
       var requestedMode;
-      if (msg.vendor === "codex") {
+      if (msg.vendor === "codex" || msg.vendor === "kiro") {
         requestedMode = "gui";
       } else if (msg.mode === "tui" || msg.mode === "gui") {
         requestedMode = msg.mode;
@@ -495,6 +495,17 @@ function attachSessions(ctx) {
         newSess = sm.createSession(sessionOpts, ws);
       }
       ws._clayActiveSession = newSess.localId;
+      // Remember the vendor only when the client asked for one explicitly.
+      // new_session without a vendor (mate sidebar, notification banner,
+      // debate) falls through to the default adapter and must not clobber
+      // the user's remembered pick.
+      if (msg.vendor && sm.lastVendor !== msg.vendor) {
+        sm.lastVendor = msg.vendor;
+        if (typeof opts.onSetProjectLastVendor === "function") {
+          opts.onSetProjectLastVendor(slug, msg.vendor);
+        }
+        send({ type: "last_vendor", vendor: msg.vendor });
+      }
       // Apply project-level email defaults to new session
       if (typeof ctx._email === "object" && ctx._email.getEmailDefaults) {
         var emailDefaults = ctx._email.getEmailDefaults();

package/lib/project.js

@@ -166,7 +166,7 @@ function createProjectContext(opts) {
   var sessionTitleMigrationScheduled = false;
 
   // --- YOKE adapters (multi-vendor, lazy init) ---
-  var _yokeState = yoke.createAdapters({ cwd: cwd, slug: slug });
+  var _yokeState = yoke.createAdapters({ cwd: cwd, slug: slug, osUsers: osUsers });
   var adapters = _yokeState.adapters;
   var defaultVendor = adapters.claude ? "claude" : Object.keys(adapters)[0] || "claude";
   var adapter = adapters[defaultVendor] || null;
@@ -428,6 +428,12 @@ function createProjectContext(opts) {
   var _srvEffort = typeof opts.onGetServerDefaultEffort === "function" ? opts.onGetServerDefaultEffort() : null;
   sm.currentEffort = (_projEffort && _projEffort.effort) || (_srvEffort && _srvEffort.effort) || "medium";
 
+  // Last vendor the user started a session with in this project. Seeds the
+  // sidebar's "New session" button so it defaults to whatever they used last
+  // instead of always launching Claude.
+  var _projLastVendor = typeof opts.onGetProjectLastVendor === "function" ? opts.onGetProjectLastVendor(slug) : null;
+  sm.lastVendor = (_projLastVendor && _projLastVendor.vendor) || null;
+
   var _projModel = typeof opts.onGetProjectDefaultModel === "function" ? opts.onGetProjectDefaultModel(slug) : null;
   var _srvModel = typeof opts.onGetServerDefaultModel === "function" ? opts.onGetServerDefaultModel() : null;
   sm._savedDefaultModel = (_projModel && _projModel.model) || (_srvModel && _srvModel.model) || null;
@@ -897,10 +903,12 @@ function createProjectContext(opts) {
       (async function() {
         if (msg.vendor) {
           try {
+            var modelLinuxUser = getLinuxUserForWs(ws);
             var vendorAdapter = adapters[msg.vendor] || null;
             if (!vendorAdapter) {
               vendorAdapter = await yoke.lazyCreateAdapter(adapters, msg.vendor, {
                 cwd: cwd,
+                linuxUser: modelLinuxUser || undefined,
                 clayPort: serverPort,
                 clayTls: serverTls,
                 clayAuthToken: serverAuthToken,
@@ -1528,14 +1536,30 @@ function createProjectContext(opts) {
       fs.rmSync(tmpDir, { recursive: true, force: true });
     } catch (e) {}
 
-    var codexShutdown = Promise.resolve(true);
-    if (adapters && adapters.codex && typeof adapters.codex.shutdown === "function") {
-      codexShutdown = adapters.codex.shutdown().catch(function(err) {
-        console.error("[project] Codex shutdown failed for " + slug + ":", err && err.message ? err.message : err);
-        return false;
+    // Shut down every adapter that owns a child process. shutdown() is
+    // optional on the YOKE contract, so adapters without one are skipped.
+    var shutdowns = [];
+    if (adapters) {
+      Object.keys(adapters).forEach(function(vendor) {
+        var adapter = adapters[vendor];
+        if (!adapter || typeof adapter.shutdown !== "function") return;
+        // Shared adapter instances (e.g. Claude) are reused across projects,
+        // so tearing one down here would kill other projects' sessions.
+        if (adapter.shared) return;
+        try {
+          shutdowns.push(Promise.resolve(adapter.shutdown()).catch(function(err) {
+            console.error("[project] " + vendor + " shutdown failed for " + slug + ":", err && err.message ? err.message : err);
+            return false;
+          }));
+        } catch (err) {
+          console.error("[project] " + vendor + " shutdown threw for " + slug + ":", err && err.message ? err.message : err);
+        }
       });
     }
-    return codexShutdown;
+    if (!shutdowns.length) return Promise.resolve(true);
+    return Promise.all(shutdowns).then(function(results) {
+      return results.every(function(r) { return r !== false; });
+    });
   }
 
   // --- Status info ---

package/lib/public/app.js

@@ -310,6 +310,12 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
     // panels
     currentModel: "",
     currentModels: [],
+    // Project's last-used vendor; seeds the sidebar's "New session" button.
+    lastVendor: "",
+    // How Claude sessions open: "gui" (default) or "tui". The server sends
+    // claude_open_mode_changed on connect; this seeds it beforehand so the
+    // new-session menu doesn't flash the TUI-only entry.
+    claudeOpenMode: "gui",
     currentMode: "default",
     currentEffort: "medium",
     currentBetas: [],