clay-server 3.4.0-beta.3 → 3.4.0-beta.5

package/lib/project-connection.js

@@ -116,7 +116,7 @@ function attachConnection(ctx) {
     if (!_warmedUp) {
       _warmedUp = true;
       if (typeof warmup === "function") {
-        try { warmup(); }
+        try { warmup(wsUser && wsUser.linuxUser ? wsUser.linuxUser : null); }
         catch (e) { console.error("[project-connection] warmup failed for " + slug + ":", e && e.message ? e.message : e); }
       }
     }

package/lib/project-debate.js

@@ -604,6 +604,7 @@ function attachDebate(ctx) {
     var _modMate = matesModule.getMate(mateCtx, debate.moderatorId);
     ctx.sdk.createMentionSession({
       vendor: _modMate ? _modMate.vendor : null,
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: claudeMd,
       initialContext: digests,
       initialMessage: quickBriefPrompt,
@@ -799,6 +800,7 @@ function attachDebate(ctx) {
     var _modMate2 = matesModule.getMate(mateCtx, debate.moderatorId);
     ctx.sdk.createMentionSession({
       vendor: _modMate2 ? _modMate2.vendor : null,
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: claudeMd,
       initialContext: moderatorContext,
       initialMessage: "Begin the debate on: " + debate.topic,
@@ -994,6 +996,7 @@ function attachDebate(ctx) {
       var _panMate = matesModule.getMate(debate.mateCtx, mateId);
       ctx.sdk.createMentionSession({
         vendor: _panMate ? _panMate.vendor : null,
+        linuxUser: debate.mateCtx && debate.mateCtx.linuxUser ? debate.mateCtx.linuxUser : undefined,
         claudeMd: claudeMd,
         initialContext: panelistContext + historyContext,
         initialMessage: "The moderator addresses you:\n\n" + moderatorText,
@@ -1530,6 +1533,7 @@ function attachDebate(ctx) {
         var _modMate3 = matesModule.getMate(mateCtx, debate.moderatorId);
         ctx.sdk.createMentionSession({
           vendor: _modMate3 ? _modMate3.vendor : null,
+          linuxUser: mateCtx.linuxUser || undefined,
           claudeMd: claudeMd,
           initialContext: moderatorContext,
           initialMessage: resumePrompt,

package/lib/project-mate-interaction.js

@@ -179,6 +179,7 @@ function attachMateInteraction(ctx) {
   var _digestQueue = [];
   var _digestBusy = false;
   var _digestWorkerTurns = 0;
+  var _digestWorkerLinuxUser = null;
   var DIGEST_WORKER_MAX_TURNS = 20;
 
   function enqueueDigest(job) {
@@ -191,6 +192,13 @@ function attachMateInteraction(ctx) {
     _digestBusy = true;
     var job = _digestQueue.shift();
 
+    if (_digestWorker && _digestWorkerLinuxUser !== (job.linuxUser || null)) {
+      try { _digestWorker.close(); } catch (e) {}
+      _digestWorker = null;
+      _digestWorkerTurns = 0;
+      _digestWorkerLinuxUser = null;
+    }
+
     var mateDir = matesModule.getMateDir(job.mateCtx, job.mateId);
     var knowledgeDir = path.join(mateDir, "knowledge");
 
@@ -315,6 +323,7 @@ function attachMateInteraction(ctx) {
       try { _digestWorker.close(); } catch (e) {}
       _digestWorker = null;
       _digestWorkerTurns = 0;
+      _digestWorkerLinuxUser = null;
     }
 
     var responseText = "";
@@ -328,12 +337,14 @@ function attachMateInteraction(ctx) {
           console.error("[digest-worker] Error:", err);
           _digestWorker = null;
           _digestWorkerTurns = 0;
+          _digestWorkerLinuxUser = null;
           if (job.onError) job.onError(err);
           processDigestQueue();
         },
       });
     } else {
       sdk.createMentionSession({
+        linuxUser: job.linuxUser || undefined,
         claudeMd: "",
         model: "haiku",
         initialContext: "[Digest Worker] You generate memory digests. Respond with ONLY JSON.",
@@ -344,10 +355,15 @@ function attachMateInteraction(ctx) {
         onError: function (err) {
           console.error("[digest-worker] Create error:", err);
           _digestWorker = null;
+          _digestWorkerLinuxUser = null;
           if (job.onError) job.onError(err);
           processDigestQueue();
         },
-      }).then(function (ws) { _digestWorker = ws; _digestWorkerTurns = 1; }).catch(function (err) {
+      }).then(function (ws) {
+        _digestWorker = ws;
+        _digestWorkerTurns = 1;
+        _digestWorkerLinuxUser = job.linuxUser || null;
+      }).catch(function (err) {
         if (job.onError) job.onError(err || new Error("digest worker creation failed"));
         processDigestQueue();
       });
@@ -378,6 +394,7 @@ function attachMateInteraction(ctx) {
 
     enqueueDigest({
       mateCtx: mateCtx,
+      linuxUser: mateCtx.linuxUser || undefined,
       mateId: mateId,
       type: "mention",
       conversationContent: conversationContent,
@@ -473,6 +490,7 @@ function attachMateInteraction(ctx) {
 
     enqueueDigest({
       mateCtx: mateCtx,
+      linuxUser: mateCtx.linuxUser || undefined,
       mateId: mateId,
       type: "dm",
       priorSummary: priorSummary || "",
@@ -716,6 +734,7 @@ function attachMateInteraction(ctx) {
       // Create new persistent mention session
       sdk.createMentionSession({
         vendor: mate.vendor || null,
+        linuxUser: getLinuxUserForSession(session) || undefined,
         claudeMd: claudeMd,
         initialContext: mentionContext,
         initialMessage: mentionFullInput,
@@ -887,6 +906,7 @@ function attachMateInteraction(ctx) {
     ].join("\n");
 
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: synthesisContext,

package/lib/project-memory.js

@@ -339,6 +339,7 @@ function attachMemory(ctx) {
     var gateText = "";
     var _gateSession = null;
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: gateContext,
@@ -448,6 +449,7 @@ function attachMemory(ctx) {
     var updateText = "";
     var _updateSession = null;
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: updateContext,
@@ -553,6 +555,7 @@ function attachMemory(ctx) {
     var initText = "";
     var _initSession = null;
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: initContext,

package/lib/project.js

@@ -835,6 +835,7 @@ function createProjectContext(opts) {
     getNotificationsModule: function () { return _notifications; },
     mateDisplayName: opts.mateDisplayName || "",
     isMate: isMate,
+    osUsers: osUsers,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
     mcpServers: getLocalMcpServers,
     getRemoteMcpServers: function () { return _mcp.getMcpServers(); },
@@ -1078,6 +1079,7 @@ function createProjectContext(opts) {
               try {
                 var readyResult = await vendorAdapter.init({
                   cwd: cwd,
+                  linuxUser: modelLinuxUser || undefined,
                   clayPort: serverPort,
                   clayTls: serverTls,
                   clayAuthToken: serverAuthToken,
@@ -1686,8 +1688,8 @@ function createProjectContext(opts) {
     getProject: function () { return project; },
     // Exposed so the first websocket connection can lazily warm up the
     // adapters for this project (see project-connection handleConnection).
-    warmup: function () {
-      sdk.warmup();
+    warmup: function (linuxUser) {
+      sdk.warmup(osUsers ? linuxUser : null);
       sdk.startIdleReaper();
       if (!osUsers && !sessionTitleMigrationScheduled) {
         sessionTitleMigrationScheduled = true;

package/lib/public/app.js

@@ -556,6 +556,22 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
   var newMsgBtnDefault = "\u2193 Latest";
   var newMsgBtnActivity = "\u2193 New activity";
 
+  // The composer grows for mobile tabs, safe areas, multiline input, and the
+  // keyboard. Keep the jump button immediately above its real height instead
+  // of relying on one fixed bottom offset.
+  function positionNewMsgButton() {
+    var inputArea = $("input-area");
+    if (!inputArea) return;
+    newMsgBtn.style.bottom = (inputArea.offsetHeight + 12) + "px";
+  }
+  var inputAreaForNewMsgBtn = $("input-area");
+  if (inputAreaForNewMsgBtn && window.ResizeObserver) {
+    new ResizeObserver(positionNewMsgButton).observe(inputAreaForNewMsgBtn);
+  } else {
+    window.addEventListener("resize", positionNewMsgButton);
+  }
+  positionNewMsgButton();
+
   messagesEl.addEventListener("scroll", function () {
     // While sticky-bottom is armed (e.g. just after history_done or a "New
     // activity" click), suppress "user scrolled up" detection. Growth-induced
@@ -932,6 +948,7 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
     messagesEl: messagesEl,
     sessionListEl: sessionListEl,
     scrollToBottom: scrollToBottom,
+    forceScrollToBottom: forceScrollToBottom,
     basePath: basePath,
     toggleUsagePanel: toggleUsagePanel,
     toggleStatusPanel: toggleStatusPanel,

package/lib/public/css/messages.css

@@ -5,12 +5,21 @@
 #messages {
   flex: 1;
   overflow-y: auto;
+  overflow-x: hidden;
   -webkit-overflow-scrolling: touch;
   overscroll-behavior-y: contain;
   padding: 20px 0 12px;
   position: relative;
 }
 
+/* Rich message content can contain wide tables, diagrams, or generated HTML.
+   Keep that content inside the chat scroller; nested code blocks still own
+   their intentional horizontal scrolling. */
+#messages > * {
+  min-width: 0;
+  max-width: 100%;
+}
+
 /* --- Remote cursors (Figma-style) --- */
 .remote-cursor {
   pointer-events: none;

package/lib/public/css/pwa-mobile.css

@@ -0,0 +1,17 @@
+/* In an iOS Home Screen app, a 100%-tall root can be measured against the
+   shortened safe-area viewport. Use the physical viewport for the root while
+   retaining safe-area padding on controls inside the app. */
+@media (max-width: 768px) {
+  html.pwa-standalone,
+  html.pwa-standalone body {
+    height: 100vh;
+  }
+}
+
+@media (max-width: 768px) and (display-mode: standalone),
+       (max-width: 768px) and (display-mode: fullscreen) {
+  html,
+  body {
+    height: 100vh;
+  }
+}

package/lib/public/css/title-bar.css

@@ -324,6 +324,25 @@
     display: none !important;
   }
 
+  .title-bar-content {
+    height: calc(48px + var(--safe-top));
+    padding: var(--safe-top) 16px 0;
+  }
+
+  /* The inline title editor must own the header while the keyboard is open.
+     Leaving the other controls visible made its usable width nearly zero. */
+  .title-bar-content.session-renaming .status,
+  .title-bar-content.session-renaming #header-left > :not(.header-rename-input) {
+    display: none !important;
+  }
+
+  .title-bar-content.session-renaming .header-rename-input {
+    flex: 1 1 100%;
+    width: 100%;
+    min-height: 36px;
+    font-size: 16px;
+  }
+
   #sidebar-column {
     width: 0 !important;
     min-width: 0 !important;

package/lib/public/index.html

@@ -30,7 +30,7 @@
 (function(){try{var k="clay-theme-vars",v=localStorage.getItem(k),r=document.documentElement;if(v){var o=JSON.parse(v),p;for(p in o)r.style.setProperty(p,o[p]);var vt=localStorage.getItem(k.replace("-vars","-variant"));if(vt==="light"){r.classList.add("light-theme");r.classList.remove("dark-theme")}else{r.classList.add("dark-theme");r.classList.remove("light-theme")}var m=document.querySelector('meta[name="theme-color"]');if(m&&o["--bg"])m.setAttribute("content",o["--bg"])}else{var sl=window.matchMedia&&window.matchMedia("(prefers-color-scheme: light)").matches;if(sl){r.classList.add("light-theme");r.classList.remove("dark-theme")}}}catch(e){}})();
 </script>
 <script>if(window.navigator.standalone||window.matchMedia("(display-mode:standalone)").matches){document.documentElement.classList.add("pwa-standalone")}</script>
-<link rel="stylesheet" href="style.css?v=20260407">
+<link rel="stylesheet" href="style.css?v=20260824f">
 <style>
 @media(max-width:768px){
   /* User messages: vertical stack, avatar on top, right-aligned */
@@ -2338,7 +2338,7 @@
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0/lib/addon-fit.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0/lib/addon-web-links.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-webgl@0/lib/addon-webgl.min.js"></script>
-<script type="module" src="app.js"></script>
+<script type="module" src="app.js?v=20260824g"></script>
 <div id="pwa-install-modal" class="pwa-modal hidden">
   <div class="pwa-modal-backdrop"></div>
   <div class="pwa-modal-card">

package/lib/public/modules/app-header.js

@@ -93,6 +93,8 @@ export function initHeader() {
       input.type = "text";
       input.className = "header-rename-input";
       input.value = currentText;
+      var titleBar = headerTitleEl.closest(".title-bar-content");
+      if (titleBar) titleBar.classList.add("session-renaming");
       headerTitleEl.style.display = "none";
       headerRenameBtn.style.display = "none";
       headerTitleEl.parentNode.insertBefore(input, headerTitleEl.nextSibling);
@@ -117,6 +119,7 @@ export function initHeader() {
           }
         }
         input.remove();
+        if (titleBar) titleBar.classList.remove("session-renaming");
         headerTitleEl.style.display = "";
         headerRenameBtn.style.display = "";
       }
@@ -126,6 +129,7 @@ export function initHeader() {
         if (e.key === "Escape") {
           e.preventDefault();
           input.remove();
+          if (titleBar) titleBar.classList.remove("session-renaming");
           headerTitleEl.style.display = "";
           headerRenameBtn.style.display = "";
         }

package/lib/public/modules/notifications.js

@@ -72,6 +72,7 @@ export function initNotifications(_ctx) {
   if (window.visualViewport) {
     var layout = $("layout");
     var mobileTabBar = document.getElementById("mobile-tab-bar");
+    var keyboardWasOpen = false;
     // Capture initial viewport height before any keyboard interaction.
     // In iOS PWA standalone mode, window.innerHeight shrinks when the
     // keyboard opens, so we need a stable baseline for comparison.
@@ -86,7 +87,12 @@ export function initNotifications(_ctx) {
       // Toggle class so CSS can remove the tab-bar bottom padding while keyboard is up
       var keyboardOpen = vv.height < stableViewportHeight - 100;
       document.body.classList.toggle("keyboard-open", keyboardOpen);
-      if (!keyboardOpen) ctx.scrollToBottom();
+      if (keyboardOpen && !keyboardWasOpen && ctx.forceScrollToBottom) {
+        requestAnimationFrame(function() { ctx.forceScrollToBottom(); });
+      } else if (!keyboardOpen) {
+        ctx.scrollToBottom();
+      }
+      keyboardWasOpen = keyboardOpen;
       // Hide tab bar when software keyboard is open
       if (mobileTabBar) {
         if (keyboardOpen) {

package/lib/public/style.css

@@ -1,12 +1,12 @@
 @import url("css/base.css");
 @import url("css/icon-strip.css");
-@import url("css/title-bar.css");
+@import url("css/title-bar.css?v=20260824");
 @import url("css/pane.css");
 @import url("css/worker-proposal.css");
 @import url("css/sidebar.css");
 @import url("css/overlays.css");
 @import url("css/menus.css");
-@import url("css/messages.css?v=20260407");
+@import url("css/messages.css?v=20260824");
 @import url("css/rewind.css");
 @import url("css/input.css");
 @import url("css/filebrowser.css");
@@ -35,3 +35,4 @@
 @import url("css/debate.css");
 @import url("css/notifications-center.css");
 @import url("css/tui-attention.css");
+@import url("css/pwa-mobile.css?v=20260824f");

package/lib/sdk-bridge.js

@@ -110,6 +110,7 @@ function createSDKBridge(opts) {
   var adapters = opts.adapters || {};
   var mateDisplayName = opts.mateDisplayName || "";
   var isMate = opts.isMate || (slug.indexOf("mate-") === 0);
+  var osUsers = !!opts.osUsers;
   var dangerouslySkipPermissions = opts.dangerouslySkipPermissions || false;
   // mcpServers may be either a static object or a getter function. The
   // getter form lets callers gate individual servers at call time (e.g.
@@ -323,6 +324,14 @@ function createSDKBridge(opts) {
   var mergeSkills = skills.mergeSkills;
 
   // --- Message processing (extracted to sdk-message-processor.js) ---
+  function getSessionLinuxUser(session) {
+    if (!osUsers || !session) return null;
+    if (session.lastLinuxUser) return session.lastLinuxUser;
+    if (!session.ownerId) return null;
+    var owner = usersModule.findUserById(session.ownerId);
+    return owner && owner.linuxUser ? owner.linuxUser : null;
+  }
+
   // Auto-generate a session title via YOKE adapter.generateTitle().
   // Triggered by sdk-message-processor after AUTO_TITLE_TURN_THRESHOLD turns.
   function autoGenerateTitle(session) {
@@ -345,7 +354,10 @@ function createSDKBridge(opts) {
     }
     console.log("[auto-title] Calling adapter.generateTitle with " + userMessages.length + " messages for session " + session.localId);
 
-    sessionAdapter.generateTitle(userMessages, { cwd: cwd }).then(function(title) {
+    sessionAdapter.generateTitle(userMessages, {
+      cwd: cwd,
+      linuxUser: getSessionLinuxUser(session) || undefined,
+    }).then(function(title) {
       if (!title || title.length < 2) return;
       title = title.substring(0, 100);
       if (!session.titleManuallySet) {
@@ -1131,7 +1143,9 @@ function createSDKBridge(opts) {
   async function rollbackConversation(session, numTurns) {
     var sessionAdapter = getAdapterForSession(session);
     if (sessionAdapter && typeof sessionAdapter.rollbackThread === "function") {
-      await sessionAdapter.rollbackThread(session.cliSessionId, numTurns);
+      await sessionAdapter.rollbackThread(session.cliSessionId, numTurns, {
+        linuxUser: getSessionLinuxUser(session) || undefined,
+      });
     }
     // Claude: conversation rollback is handled by rewindFiles + local history trim
   }
@@ -1143,7 +1157,11 @@ function createSDKBridge(opts) {
 
   async function forkSessionUnified(session, uuid) {
     var sessionAdapter = getAdapterForSession(session);
-    var result = await sessionAdapter.forkSession(session.cliSessionId, { upToMessageId: uuid, dir: cwd });
+    var result = await sessionAdapter.forkSession(session.cliSessionId, {
+      upToMessageId: uuid,
+      dir: cwd,
+      linuxUser: getSessionLinuxUser(session) || undefined,
+    });
     if (!result || !result.sessionId) throw new Error("Fork returned no session id");
 
     // Adapters with rollbackThread (e.g. Codex) use local history copy
@@ -1471,6 +1489,7 @@ function createSDKBridge(opts) {
 
     var queryOpts = {
       cwd: cwd,
+      linuxUser: linuxUser || undefined,
       // appendSystemPrompt, NOT systemPrompt: a plain-string systemPrompt
       // REPLACES the entire Claude Code system prompt (sdk.d.ts:2096), which
       // would strip the driver session down to the two-sentence pair preset.
@@ -2017,7 +2036,7 @@ function createSDKBridge(opts) {
   // Creates a mention session that can be reused across multiple mentions
   // within a conversation flow (session continuity).
   async function createMentionSession(opts) {
-    // opts: { vendor, claudeMd, initialContext, initialMessage, onDelta, onDone, onError, onActivity }
+    // opts: { vendor, linuxUser, claudeMd, initialContext, initialMessage, onDelta, onDone, onError, onActivity }
     var abortController = new AbortController();
 
     // Current response callbacks (swapped on each pushMessage)
@@ -2037,6 +2056,7 @@ function createSDKBridge(opts) {
     try {
       handle = await mentionAdapter.createQuery({
         cwd: cwd,
+        linuxUser: opts.linuxUser || undefined,
         systemPrompt: opts.claudeMd,
         model: opts.model || undefined,
         toolServers: opts.includeMcpServers ? (mergeMcpServers(getMcpServers(), getRemoteMcpServers) || undefined) : undefined,

package/lib/session-notes-mcp-server.js

@@ -2,7 +2,13 @@
 
 var buildShape = require("./session-spawn-mcp-server").buildShape;
 
-var MEMORY_CONTRACT = "The sticky-note board persists across sessions and is a user-facing artifact shared with people and Clay agents, not private agent scratch space. Default to not writing. Create a note proactively only when the user explicitly asks to remember or track something, or when all of these are true: it will remain useful after the current task and session, it is not already adequately recorded in the repository or another note, and the user would likely be glad to find it on the board a week later. Good notes capture an unresolved commitment, durable product decision, user preference, constraint, or handoff that will materially change future work. Never create a note merely because work is important, lengthy, spans agents or restarts, or might help another agent. Do not record completed work, implementation details, test results, investigation logs, transient blockers, conversation summaries, or announcements of your own activity. When uncertain, do not write. Updates are visible too: update only when durable state materially changes, and remove a note created by your session when it stops being useful instead of turning it into a completion log. Put a concise plain-text title on the first line, stay focused on one topic, and include only the context needed for future action.";
+var MEMORY_CONTRACT =
+  "The sticky-note board persists across sessions and is a user-facing artifact shared with people and Clay agents, not private agent scratch space. " +
+  "Default to not writing. Create a note proactively only when the user explicitly asks to remember or track something, or when all of these are true: it will remain useful after the current task and session, it is not already adequately recorded in the repository or another note, and the user would likely be glad to find it on the board a week later. " +
+  "Good notes capture an unresolved commitment, durable product decision, user preference, constraint, or handoff that will materially change future work. " +
+  "Important exception for deferred defects: while doing code or technical work, actively create a sticky note when you discover a concrete defect, regression risk, security issue, or data-loss risk that is outside the current session goal and will remain unfixed when the turn ends. Do not wait for the user to ask. Include the observable evidence, affected component, likely impact, and a clear next action. Check active notes first when a duplicate is plausible. Do not create defect notes for speculation, general cleanup ideas, or problems you fixed in the current session. " +
+  "Never create a note merely because work is important, lengthy, spans agents or restarts, or might help another agent. Do not record completed work, implementation details, test results, investigation logs, transient blockers, conversation summaries, or announcements of your own activity. When uncertain, do not write. " +
+  "Updates are visible too: update only when durable state materially changes, and remove a note created by your session when it stops being useful instead of turning it into a completion log. Put a concise plain-text title on the first line, stay focused on one topic, and include only the context needed for future action.";
 
 function getToolDefs(handlers) {
   return [

package/lib/yoke/adapters/codex.js

@@ -7,6 +7,7 @@ var path = require("path");
 var fs = require("fs");
 var { CodexAppServer } = require("../codex-app-server");
 var skillDiscovery = require("../skill-discovery");
+var { resolveOsUserInfo } = require("../../os-users");
 
 // --- Event flattening ---
 // Converts app-server JSON-RPC notifications into flat objects with a yokeType field.
@@ -1220,6 +1221,13 @@ function createCodexAdapter(opts) {
   var _cwd = (opts && opts.cwd) || process.cwd();
   var _slug = (opts && opts.slug) || "";
   var _defaultInitOpts = Object.assign({}, opts || {});
+  var _runtimeLinuxUser = (opts && opts.runtimeLinuxUser) || null;
+  var _requiresLinuxUser = !!(opts && opts.osUsers) && !_runtimeLinuxUser;
+  var _userRuntimes = Object.create(null);
+  var _resolveOsUserInfo = (opts && opts.resolveOsUserInfo) || resolveOsUserInfo;
+  var _createAppServer = (opts && opts.createAppServer) || function(serverOpts) {
+    return new CodexAppServer(null, serverOpts);
+  };
   // Codex models are a fixed list (the app-server doesn't enumerate them), so
   // model listing must not depend on a successful app-server init — otherwise a
   // slow/failed `initialize` leaves the picker empty and the chip shows the
@@ -1244,6 +1252,45 @@ function createCodexAdapter(opts) {
   var _shuttingDown = false;
   var _activeQueries = [];
 
+  function withoutLinuxUser(callOpts) {
+    var cleaned = Object.assign({}, callOpts || {});
+    delete cleaned.linuxUser;
+    return cleaned;
+  }
+
+  function getUserRuntime(linuxUser) {
+    if (!linuxUser) return null;
+    if (_runtimeLinuxUser) {
+      if (_runtimeLinuxUser !== linuxUser) {
+        throw new Error("Codex runtime user mismatch: expected " + _runtimeLinuxUser + ", received " + linuxUser);
+      }
+      return adapter;
+    }
+    if (!_userRuntimes[linuxUser]) {
+      var runtimeOpts = Object.assign({}, _defaultInitOpts, {
+        runtimeLinuxUser: linuxUser,
+      });
+      delete runtimeOpts.linuxUser;
+      _userRuntimes[linuxUser] = createCodexAdapter(runtimeOpts);
+    }
+    return _userRuntimes[linuxUser];
+  }
+
+  function shutdownUserRuntimes(method, idleMs) {
+    var users = Object.keys(_userRuntimes);
+    if (!users.length) return Promise.resolve([]);
+    return Promise.all(users.map(function(linuxUser) {
+      var runtime = _userRuntimes[linuxUser];
+      var result = method === "shutdownIfIdle"
+        ? runtime.shutdownIfIdle(idleMs)
+        : runtime.shutdown();
+      return Promise.resolve(result).then(function(stopped) {
+        if (method === "shutdown" || stopped) delete _userRuntimes[linuxUser];
+        return stopped;
+      });
+    }));
+  }
+
   function updateLastActiveAt() {
     _lastActiveAt = Date.now();
   }
@@ -1396,6 +1443,16 @@ function createCodexAdapter(opts) {
     vendor: "codex",
 
     init: function(initOpts) {
+      var requestedLinuxUser = initOpts && initOpts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).init(withoutLinuxUser(initOpts));
+      }
+      if (_requiresLinuxUser) {
+        return Promise.reject(new Error("Codex requires a mapped Linux user while OS-user isolation is enabled"));
+      }
+      if (_runtimeLinuxUser && requestedLinuxUser && requestedLinuxUser !== _runtimeLinuxUser) {
+        return Promise.reject(new Error("Codex runtime user mismatch"));
+      }
       if (_shuttingDown) {
         return Promise.reject(createShutdownError());
       }
@@ -1412,6 +1469,9 @@ function createCodexAdapter(opts) {
 
       _initPromise = (async function() {
         var serverOpts = { cwd: _cwd };
+        if (_runtimeLinuxUser) {
+          serverOpts.osUserInfo = _resolveOsUserInfo(_runtimeLinuxUser);
+        }
 
         // Extract adapter options
         if (effectiveInitOpts && effectiveInitOpts.adapterOptions && effectiveInitOpts.adapterOptions.CODEX) {
@@ -1478,7 +1538,7 @@ function createCodexAdapter(opts) {
         }
 
         // Spawn and initialize app-server
-        _appServer = new CodexAppServer(null, serverOpts);
+        _appServer = _createAppServer(serverOpts);
         await _appServer.start();
 
         await _appServer.send("initialize", {
@@ -1565,6 +1625,16 @@ function createCodexAdapter(opts) {
     },
 
     createQuery: async function(queryOpts) {
+      var requestedLinuxUser = queryOpts && queryOpts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).createQuery(withoutLinuxUser(queryOpts));
+      }
+      if (_requiresLinuxUser) {
+        throw new Error("Codex requires a mapped Linux user while OS-user isolation is enabled");
+      }
+      if (_runtimeLinuxUser && requestedLinuxUser && requestedLinuxUser !== _runtimeLinuxUser) {
+        throw new Error("Codex runtime user mismatch");
+      }
       if (_shuttingDown) {
         throw createShutdownError();
       }
@@ -1661,6 +1731,13 @@ function createCodexAdapter(opts) {
 
     // --- Title generation ---
     generateTitle: async function(messages, opts) {
+      var requestedLinuxUser = opts && opts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).generateTitle(messages, withoutLinuxUser(opts));
+      }
+      if (_requiresLinuxUser) {
+        throw new Error("Codex requires a mapped Linux user while OS-user isolation is enabled");
+      }
       var systemPrompt = "You are a title generator. Output only a short title (3-8 words). No quotes, no punctuation at the end, no explanation.";
       var prompt = "Below is a conversation between a user and an AI assistant. Generate a short, descriptive title (3-8 words) that captures the main topic. Reply with ONLY the title, nothing else.\n\n";
       for (var i = 0; i < messages.length; i++) {
@@ -1708,6 +1785,11 @@ function createCodexAdapter(opts) {
     listSessions: function() { return Promise.resolve([]); },
     renameSession: function() { return Promise.resolve(); },
     forkSession: function(threadId, opts) {
+      var requestedLinuxUser = opts && opts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).forkSession(threadId, withoutLinuxUser(opts));
+      }
+      if (_requiresLinuxUser) return Promise.reject(new Error("Codex requires a mapped Linux user while OS-user isolation is enabled"));
       if (!_appServer || !_appServer.started) return Promise.resolve(null);
       return _appServer.send("thread/fork", { threadId: threadId }, 30000).then(function(result) {
         var newThreadId = (result && result.thread) ? result.thread.id : null;
@@ -1715,17 +1797,30 @@ function createCodexAdapter(opts) {
         return { sessionId: newThreadId };
       });
     },
-    rollbackThread: function(threadId, numTurns) {
+    rollbackThread: function(threadId, numTurns, opts) {
+      var requestedLinuxUser = opts && opts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).rollbackThread(threadId, numTurns, withoutLinuxUser(opts));
+      }
+      if (_requiresLinuxUser) return Promise.reject(new Error("Codex requires a mapped Linux user while OS-user isolation is enabled"));
       if (!_appServer || !_appServer.started) return Promise.resolve(null);
       return _appServer.send("thread/rollback", { threadId: threadId, numTurns: numTurns }, 30000);
     },
 
     // Shutdown the app-server process
     shutdown: function() {
-      return beginShutdown(true);
+      return Promise.all([
+        beginShutdown(true),
+        shutdownUserRuntimes("shutdown"),
+      ]).then(function() { return true; });
     },
 
     shutdownIfIdle: function(idleMs) {
+      if (!_runtimeLinuxUser && Object.keys(_userRuntimes).length > 0) {
+        return shutdownUserRuntimes("shutdownIfIdle", idleMs).then(function(results) {
+          return results.some(function(stopped) { return !!stopped; });
+        });
+      }
       if (_shuttingDown || _shutdownPromise) return Promise.resolve(false);
       if (_initPromise) return Promise.resolve(false);
       if (!_appServer) return Promise.resolve(false);

package/lib/yoke/codex-app-server.js

@@ -9,6 +9,8 @@ var readline = require("readline");
 var path = require("path");
 var fs = require("fs");
 var { createRequire } = require("module");
+var { buildUserEnv } = require("../build-user-env");
+var { wrapSpawnAsUser } = require("../os-users");
 
 // --- Find the codex binary path ---
 // Mirrors the logic from @openai/codex-sdk findCodexPath()
@@ -120,14 +122,30 @@ function CodexAppServer(executablePath, opts) {
   this._stderrBuf = "";
 }
 
+function buildSpawnSpec(executablePath, args, opts, wrapFn) {
+  opts = opts || {};
+  var osUserInfo = opts.osUserInfo || null;
+  var env = osUserInfo
+    ? Object.assign(buildUserEnv(osUserInfo), opts.env || {})
+    : Object.assign({}, process.env, opts.env || {});
+  var spawnOptions = {
+    stdio: ["pipe", "pipe", "pipe"],
+    env: env,
+    cwd: opts.cwd || process.cwd(),
+  };
+  if (osUserInfo) {
+    spawnOptions.uid = osUserInfo.uid;
+    spawnOptions.gid = osUserInfo.gid;
+  }
+  return (wrapFn || wrapSpawnAsUser)(executablePath, args, spawnOptions);
+}
+
 CodexAppServer.prototype.start = function() {
   var self = this;
 
   return new Promise(function(resolve, reject) {
     try {
       var args = ["app-server"];
-      var env = Object.assign({}, process.env, self.opts.env || {});
-
       // Pass config overrides via --config key=value flags
       if (self.opts.config) {
         var configArgs = serializeConfig(self.opts.config, "");
@@ -136,13 +154,11 @@ CodexAppServer.prototype.start = function() {
         }
       }
 
-      console.log("[codex-app-server] Spawning:", self.executablePath, args.join(" "));
+      var spawnSpec = buildSpawnSpec(self.executablePath, args, self.opts);
+      var userSuffix = self.opts.osUserInfo ? " as " + self.opts.osUserInfo.user : "";
+      console.log("[codex-app-server] Spawning" + userSuffix + ":", spawnSpec.command, spawnSpec.args.join(" "));
 
-      self.proc = spawn(self.executablePath, args, {
-        stdio: ["pipe", "pipe", "pipe"],
-        env: env,
-        cwd: self.opts.cwd || process.cwd(),
-      });
+      self.proc = spawn(spawnSpec.command, spawnSpec.args, spawnSpec.options);
 
       self.proc.on("error", function(err) {
         console.error("[codex-app-server] Process error:", err.message);
@@ -383,4 +399,5 @@ CodexAppServer.prototype.stop = function() {
 module.exports = {
   CodexAppServer: CodexAppServer,
   findCodexPath: findCodexPath,
+  buildSpawnSpec: buildSpawnSpec,
 };

package/lib/yoke/index.js

@@ -350,7 +350,7 @@ function createAdapters(opts) {
 
   if (installed.codex && supportsConfiguredIsolation("codex")) {
     try {
-      adapters.codex = createAdapter({ vendor: "codex", cwd: opts.cwd, slug: opts.slug });
+      adapters.codex = createAdapter({ vendor: "codex", cwd: opts.cwd, slug: opts.slug, osUsers: !!opts.osUsers });
       auth.codex = true;
       console.log("[yoke] Adapter created: codex");
     } catch (e) {
@@ -411,7 +411,12 @@ async function lazyCreateAdapter(adapters, vendor, opts) {
   if (!installed[vendor]) return null;
 
   try {
-    var ad = createAdapter({ vendor: vendor, cwd: opts.cwd, slug: opts.slug });
+    var ad = createAdapter({
+      vendor: vendor,
+      cwd: opts.cwd,
+      slug: opts.slug,
+      osUsers: !!(opts.osUsers || opts.linuxUser),
+    });
     if (typeof ad.init === "function") {
       await ad.init(opts || {});
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "3.4.0-beta.3",
+  "version": "3.4.0-beta.5",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",