clay-server 3.4.0-beta.4 → 3.4.0-beta.6

package/lib/project-connection.js

@@ -22,6 +22,17 @@ function dispatchMessageSafely(handleMessage, sendTo, slug, ws, msg) {
   }
 }
 
+function buildInitialModelInfo(sm, initialVendor, initialModel, initialModels) {
+  return {
+    type: "model_info",
+    model: initialModel || "",
+    models: initialModels || [],
+    vendor: initialVendor,
+    availableVendors: sm.availableVendors || [],
+    installedVendors: sm.installedVendors || [],
+  };
+}
+
 /**
  * Attach connection/disconnection handlers to a project context.
  *
@@ -116,7 +127,7 @@ function attachConnection(ctx) {
     if (!_warmedUp) {
       _warmedUp = true;
       if (typeof warmup === "function") {
-        try { warmup(); }
+        try { warmup(wsUser && wsUser.linuxUser ? wsUser.linuxUser : null); }
         catch (e) { console.error("[project-connection] warmup failed for " + slug + ":", e && e.message ? e.message : e); }
       }
     }
@@ -167,9 +178,9 @@ function attachConnection(ctx) {
       sendTo(ws, { type: "slash_commands", commands: sm.slashCommands });
     }
     var initialModel = (restoredActive && restoredActive.model) || sm.currentModel || "";
-    if (initialModel) {
-      sendTo(ws, { type: "model_info", model: initialModel, models: initialModels, vendor: initialVendor, availableVendors: sm.availableVendors || [], installedVendors: sm.installedVendors || [] });
-    }
+    // Vendor installation state is needed even before a new project has a
+    // model. Always send it so reconnects cannot fall back to "Not installed."
+    sendTo(ws, buildInitialModelInfo(sm, initialVendor, initialModel, initialModels));
     sendTo(ws, { type: "config_state", model: initialModel, mode: sm.currentPermissionMode || "default", effort: initialEffort || "medium", betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
     sendTo(ws, { type: "last_vendor", vendor: sm.lastVendor || "" });
     sendTo(ws, Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
@@ -333,4 +344,8 @@ function attachConnection(ctx) {
   };
 }
 
-module.exports = { attachConnection: attachConnection, dispatchMessageSafely: dispatchMessageSafely };
+module.exports = {
+  attachConnection: attachConnection,
+  buildInitialModelInfo: buildInitialModelInfo,
+  dispatchMessageSafely: dispatchMessageSafely,
+};

package/lib/project-debate.js

@@ -604,6 +604,7 @@ function attachDebate(ctx) {
     var _modMate = matesModule.getMate(mateCtx, debate.moderatorId);
     ctx.sdk.createMentionSession({
       vendor: _modMate ? _modMate.vendor : null,
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: claudeMd,
       initialContext: digests,
       initialMessage: quickBriefPrompt,
@@ -799,6 +800,7 @@ function attachDebate(ctx) {
     var _modMate2 = matesModule.getMate(mateCtx, debate.moderatorId);
     ctx.sdk.createMentionSession({
       vendor: _modMate2 ? _modMate2.vendor : null,
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: claudeMd,
       initialContext: moderatorContext,
       initialMessage: "Begin the debate on: " + debate.topic,
@@ -994,6 +996,7 @@ function attachDebate(ctx) {
       var _panMate = matesModule.getMate(debate.mateCtx, mateId);
       ctx.sdk.createMentionSession({
         vendor: _panMate ? _panMate.vendor : null,
+        linuxUser: debate.mateCtx && debate.mateCtx.linuxUser ? debate.mateCtx.linuxUser : undefined,
         claudeMd: claudeMd,
         initialContext: panelistContext + historyContext,
         initialMessage: "The moderator addresses you:\n\n" + moderatorText,
@@ -1530,6 +1533,7 @@ function attachDebate(ctx) {
         var _modMate3 = matesModule.getMate(mateCtx, debate.moderatorId);
         ctx.sdk.createMentionSession({
           vendor: _modMate3 ? _modMate3.vendor : null,
+          linuxUser: mateCtx.linuxUser || undefined,
           claudeMd: claudeMd,
           initialContext: moderatorContext,
           initialMessage: resumePrompt,

package/lib/project-mate-interaction.js

@@ -179,6 +179,7 @@ function attachMateInteraction(ctx) {
   var _digestQueue = [];
   var _digestBusy = false;
   var _digestWorkerTurns = 0;
+  var _digestWorkerLinuxUser = null;
   var DIGEST_WORKER_MAX_TURNS = 20;
 
   function enqueueDigest(job) {
@@ -191,6 +192,13 @@ function attachMateInteraction(ctx) {
     _digestBusy = true;
     var job = _digestQueue.shift();
 
+    if (_digestWorker && _digestWorkerLinuxUser !== (job.linuxUser || null)) {
+      try { _digestWorker.close(); } catch (e) {}
+      _digestWorker = null;
+      _digestWorkerTurns = 0;
+      _digestWorkerLinuxUser = null;
+    }
+
     var mateDir = matesModule.getMateDir(job.mateCtx, job.mateId);
     var knowledgeDir = path.join(mateDir, "knowledge");
 
@@ -315,6 +323,7 @@ function attachMateInteraction(ctx) {
       try { _digestWorker.close(); } catch (e) {}
       _digestWorker = null;
       _digestWorkerTurns = 0;
+      _digestWorkerLinuxUser = null;
     }
 
     var responseText = "";
@@ -328,12 +337,14 @@ function attachMateInteraction(ctx) {
           console.error("[digest-worker] Error:", err);
           _digestWorker = null;
           _digestWorkerTurns = 0;
+          _digestWorkerLinuxUser = null;
           if (job.onError) job.onError(err);
           processDigestQueue();
         },
       });
     } else {
       sdk.createMentionSession({
+        linuxUser: job.linuxUser || undefined,
         claudeMd: "",
         model: "haiku",
         initialContext: "[Digest Worker] You generate memory digests. Respond with ONLY JSON.",
@@ -344,10 +355,15 @@ function attachMateInteraction(ctx) {
         onError: function (err) {
           console.error("[digest-worker] Create error:", err);
           _digestWorker = null;
+          _digestWorkerLinuxUser = null;
           if (job.onError) job.onError(err);
           processDigestQueue();
         },
-      }).then(function (ws) { _digestWorker = ws; _digestWorkerTurns = 1; }).catch(function (err) {
+      }).then(function (ws) {
+        _digestWorker = ws;
+        _digestWorkerTurns = 1;
+        _digestWorkerLinuxUser = job.linuxUser || null;
+      }).catch(function (err) {
         if (job.onError) job.onError(err || new Error("digest worker creation failed"));
         processDigestQueue();
       });
@@ -378,6 +394,7 @@ function attachMateInteraction(ctx) {
 
     enqueueDigest({
       mateCtx: mateCtx,
+      linuxUser: mateCtx.linuxUser || undefined,
       mateId: mateId,
       type: "mention",
       conversationContent: conversationContent,
@@ -473,6 +490,7 @@ function attachMateInteraction(ctx) {
 
     enqueueDigest({
       mateCtx: mateCtx,
+      linuxUser: mateCtx.linuxUser || undefined,
       mateId: mateId,
       type: "dm",
       priorSummary: priorSummary || "",
@@ -716,6 +734,7 @@ function attachMateInteraction(ctx) {
       // Create new persistent mention session
       sdk.createMentionSession({
         vendor: mate.vendor || null,
+        linuxUser: getLinuxUserForSession(session) || undefined,
         claudeMd: claudeMd,
         initialContext: mentionContext,
         initialMessage: mentionFullInput,
@@ -887,6 +906,7 @@ function attachMateInteraction(ctx) {
     ].join("\n");
 
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: synthesisContext,

package/lib/project-memory.js

@@ -339,6 +339,7 @@ function attachMemory(ctx) {
     var gateText = "";
     var _gateSession = null;
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: gateContext,
@@ -448,6 +449,7 @@ function attachMemory(ctx) {
     var updateText = "";
     var _updateSession = null;
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: updateContext,
@@ -553,6 +555,7 @@ function attachMemory(ctx) {
     var initText = "";
     var _initSession = null;
     sdk.createMentionSession({
+      linuxUser: mateCtx.linuxUser || undefined,
       claudeMd: "",
       model: "haiku",
       initialContext: initContext,

package/lib/project.js

@@ -835,6 +835,7 @@ function createProjectContext(opts) {
     getNotificationsModule: function () { return _notifications; },
     mateDisplayName: opts.mateDisplayName || "",
     isMate: isMate,
+    osUsers: osUsers,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
     mcpServers: getLocalMcpServers,
     getRemoteMcpServers: function () { return _mcp.getMcpServers(); },
@@ -1078,6 +1079,7 @@ function createProjectContext(opts) {
               try {
                 var readyResult = await vendorAdapter.init({
                   cwd: cwd,
+                  linuxUser: modelLinuxUser || undefined,
                   clayPort: serverPort,
                   clayTls: serverTls,
                   clayAuthToken: serverAuthToken,
@@ -1686,8 +1688,8 @@ function createProjectContext(opts) {
     getProject: function () { return project; },
     // Exposed so the first websocket connection can lazily warm up the
     // adapters for this project (see project-connection handleConnection).
-    warmup: function () {
-      sdk.warmup();
+    warmup: function (linuxUser) {
+      sdk.warmup(osUsers ? linuxUser : null);
       sdk.startIdleReaper();
       if (!osUsers && !sessionTitleMigrationScheduled) {
         sessionTitleMigrationScheduled = true;

package/lib/public/app.js

@@ -556,6 +556,22 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
   var newMsgBtnDefault = "\u2193 Latest";
   var newMsgBtnActivity = "\u2193 New activity";
 
+  // The composer grows for mobile tabs, safe areas, multiline input, and the
+  // keyboard. Keep the jump button immediately above its real height instead
+  // of relying on one fixed bottom offset.
+  function positionNewMsgButton() {
+    var inputArea = $("input-area");
+    if (!inputArea) return;
+    newMsgBtn.style.bottom = (inputArea.offsetHeight + 12) + "px";
+  }
+  var inputAreaForNewMsgBtn = $("input-area");
+  if (inputAreaForNewMsgBtn && window.ResizeObserver) {
+    new ResizeObserver(positionNewMsgButton).observe(inputAreaForNewMsgBtn);
+  } else {
+    window.addEventListener("resize", positionNewMsgButton);
+  }
+  positionNewMsgButton();
+
   messagesEl.addEventListener("scroll", function () {
     // While sticky-bottom is armed (e.g. just after history_done or a "New
     // activity" click), suppress "user scrolled up" detection. Growth-induced
@@ -932,6 +948,7 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
     messagesEl: messagesEl,
     sessionListEl: sessionListEl,
     scrollToBottom: scrollToBottom,
+    forceScrollToBottom: forceScrollToBottom,
     basePath: basePath,
     toggleUsagePanel: toggleUsagePanel,
     toggleStatusPanel: toggleStatusPanel,

package/lib/public/css/messages.css

@@ -5,12 +5,21 @@
 #messages {
   flex: 1;
   overflow-y: auto;
+  overflow-x: hidden;
   -webkit-overflow-scrolling: touch;
   overscroll-behavior-y: contain;
   padding: 20px 0 12px;
   position: relative;
 }
 
+/* Rich message content can contain wide tables, diagrams, or generated HTML.
+   Keep that content inside the chat scroller; nested code blocks still own
+   their intentional horizontal scrolling. */
+#messages > * {
+  min-width: 0;
+  max-width: 100%;
+}
+
 /* --- Remote cursors (Figma-style) --- */
 .remote-cursor {
   pointer-events: none;

package/lib/public/css/pwa-mobile.css

@@ -0,0 +1,17 @@
+/* In an iOS Home Screen app, a 100%-tall root can be measured against the
+   shortened safe-area viewport. Use the physical viewport for the root while
+   retaining safe-area padding on controls inside the app. */
+@media (max-width: 768px) {
+  html.pwa-standalone,
+  html.pwa-standalone body {
+    height: 100vh;
+  }
+}
+
+@media (max-width: 768px) and (display-mode: standalone),
+       (max-width: 768px) and (display-mode: fullscreen) {
+  html,
+  body {
+    height: 100vh;
+  }
+}

package/lib/public/css/title-bar.css

@@ -324,6 +324,25 @@
     display: none !important;
   }
 
+  .title-bar-content {
+    height: calc(48px + var(--safe-top));
+    padding: var(--safe-top) 16px 0;
+  }
+
+  /* The inline title editor must own the header while the keyboard is open.
+     Leaving the other controls visible made its usable width nearly zero. */
+  .title-bar-content.session-renaming .status,
+  .title-bar-content.session-renaming #header-left > :not(.header-rename-input) {
+    display: none !important;
+  }
+
+  .title-bar-content.session-renaming .header-rename-input {
+    flex: 1 1 100%;
+    width: 100%;
+    min-height: 36px;
+    font-size: 16px;
+  }
+
   #sidebar-column {
     width: 0 !important;
     min-width: 0 !important;

package/lib/public/index.html

@@ -30,7 +30,7 @@
 (function(){try{var k="clay-theme-vars",v=localStorage.getItem(k),r=document.documentElement;if(v){var o=JSON.parse(v),p;for(p in o)r.style.setProperty(p,o[p]);var vt=localStorage.getItem(k.replace("-vars","-variant"));if(vt==="light"){r.classList.add("light-theme");r.classList.remove("dark-theme")}else{r.classList.add("dark-theme");r.classList.remove("light-theme")}var m=document.querySelector('meta[name="theme-color"]');if(m&&o["--bg"])m.setAttribute("content",o["--bg"])}else{var sl=window.matchMedia&&window.matchMedia("(prefers-color-scheme: light)").matches;if(sl){r.classList.add("light-theme");r.classList.remove("dark-theme")}}}catch(e){}})();
 </script>
 <script>if(window.navigator.standalone||window.matchMedia("(display-mode:standalone)").matches){document.documentElement.classList.add("pwa-standalone")}</script>
-<link rel="stylesheet" href="style.css?v=20260407">
+<link rel="stylesheet" href="style.css?v=20260824f">
 <style>
 @media(max-width:768px){
   /* User messages: vertical stack, avatar on top, right-aligned */
@@ -2338,7 +2338,7 @@
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0/lib/addon-fit.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0/lib/addon-web-links.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-webgl@0/lib/addon-webgl.min.js"></script>
-<script type="module" src="app.js"></script>
+<script type="module" src="app.js?v=20260824g"></script>
 <div id="pwa-install-modal" class="pwa-modal hidden">
   <div class="pwa-modal-backdrop"></div>
   <div class="pwa-modal-card">

package/lib/public/modules/app-header.js

@@ -93,6 +93,8 @@ export function initHeader() {
       input.type = "text";
       input.className = "header-rename-input";
       input.value = currentText;
+      var titleBar = headerTitleEl.closest(".title-bar-content");
+      if (titleBar) titleBar.classList.add("session-renaming");
       headerTitleEl.style.display = "none";
       headerRenameBtn.style.display = "none";
       headerTitleEl.parentNode.insertBefore(input, headerTitleEl.nextSibling);
@@ -117,6 +119,7 @@ export function initHeader() {
           }
         }
         input.remove();
+        if (titleBar) titleBar.classList.remove("session-renaming");
         headerTitleEl.style.display = "";
         headerRenameBtn.style.display = "";
       }
@@ -126,6 +129,7 @@ export function initHeader() {
         if (e.key === "Escape") {
           e.preventDefault();
           input.remove();
+          if (titleBar) titleBar.classList.remove("session-renaming");
           headerTitleEl.style.display = "";
           headerRenameBtn.style.display = "";
         }

package/lib/public/modules/notifications.js

@@ -72,6 +72,7 @@ export function initNotifications(_ctx) {
   if (window.visualViewport) {
     var layout = $("layout");
     var mobileTabBar = document.getElementById("mobile-tab-bar");
+    var keyboardWasOpen = false;
     // Capture initial viewport height before any keyboard interaction.
     // In iOS PWA standalone mode, window.innerHeight shrinks when the
     // keyboard opens, so we need a stable baseline for comparison.
@@ -86,7 +87,12 @@ export function initNotifications(_ctx) {
       // Toggle class so CSS can remove the tab-bar bottom padding while keyboard is up
       var keyboardOpen = vv.height < stableViewportHeight - 100;
       document.body.classList.toggle("keyboard-open", keyboardOpen);
-      if (!keyboardOpen) ctx.scrollToBottom();
+      if (keyboardOpen && !keyboardWasOpen && ctx.forceScrollToBottom) {
+        requestAnimationFrame(function() { ctx.forceScrollToBottom(); });
+      } else if (!keyboardOpen) {
+        ctx.scrollToBottom();
+      }
+      keyboardWasOpen = keyboardOpen;
       // Hide tab bar when software keyboard is open
       if (mobileTabBar) {
         if (keyboardOpen) {

package/lib/public/style.css

@@ -1,12 +1,12 @@
 @import url("css/base.css");
 @import url("css/icon-strip.css");
-@import url("css/title-bar.css");
+@import url("css/title-bar.css?v=20260824");
 @import url("css/pane.css");
 @import url("css/worker-proposal.css");
 @import url("css/sidebar.css");
 @import url("css/overlays.css");
 @import url("css/menus.css");
-@import url("css/messages.css?v=20260407");
+@import url("css/messages.css?v=20260824");
 @import url("css/rewind.css");
 @import url("css/input.css");
 @import url("css/filebrowser.css");
@@ -35,3 +35,4 @@
 @import url("css/debate.css");
 @import url("css/notifications-center.css");
 @import url("css/tui-attention.css");
+@import url("css/pwa-mobile.css?v=20260824f");

package/lib/sdk-bridge.js

@@ -110,6 +110,7 @@ function createSDKBridge(opts) {
   var adapters = opts.adapters || {};
   var mateDisplayName = opts.mateDisplayName || "";
   var isMate = opts.isMate || (slug.indexOf("mate-") === 0);
+  var osUsers = !!opts.osUsers;
   var dangerouslySkipPermissions = opts.dangerouslySkipPermissions || false;
   // mcpServers may be either a static object or a getter function. The
   // getter form lets callers gate individual servers at call time (e.g.
@@ -323,6 +324,14 @@ function createSDKBridge(opts) {
   var mergeSkills = skills.mergeSkills;
 
   // --- Message processing (extracted to sdk-message-processor.js) ---
+  function getSessionLinuxUser(session) {
+    if (!osUsers || !session) return null;
+    if (session.lastLinuxUser) return session.lastLinuxUser;
+    if (!session.ownerId) return null;
+    var owner = usersModule.findUserById(session.ownerId);
+    return owner && owner.linuxUser ? owner.linuxUser : null;
+  }
+
   // Auto-generate a session title via YOKE adapter.generateTitle().
   // Triggered by sdk-message-processor after AUTO_TITLE_TURN_THRESHOLD turns.
   function autoGenerateTitle(session) {
@@ -345,7 +354,10 @@ function createSDKBridge(opts) {
     }
     console.log("[auto-title] Calling adapter.generateTitle with " + userMessages.length + " messages for session " + session.localId);
 
-    sessionAdapter.generateTitle(userMessages, { cwd: cwd }).then(function(title) {
+    sessionAdapter.generateTitle(userMessages, {
+      cwd: cwd,
+      linuxUser: getSessionLinuxUser(session) || undefined,
+    }).then(function(title) {
       if (!title || title.length < 2) return;
       title = title.substring(0, 100);
       if (!session.titleManuallySet) {
@@ -1131,7 +1143,9 @@ function createSDKBridge(opts) {
   async function rollbackConversation(session, numTurns) {
     var sessionAdapter = getAdapterForSession(session);
     if (sessionAdapter && typeof sessionAdapter.rollbackThread === "function") {
-      await sessionAdapter.rollbackThread(session.cliSessionId, numTurns);
+      await sessionAdapter.rollbackThread(session.cliSessionId, numTurns, {
+        linuxUser: getSessionLinuxUser(session) || undefined,
+      });
     }
     // Claude: conversation rollback is handled by rewindFiles + local history trim
   }
@@ -1143,7 +1157,11 @@ function createSDKBridge(opts) {
 
   async function forkSessionUnified(session, uuid) {
     var sessionAdapter = getAdapterForSession(session);
-    var result = await sessionAdapter.forkSession(session.cliSessionId, { upToMessageId: uuid, dir: cwd });
+    var result = await sessionAdapter.forkSession(session.cliSessionId, {
+      upToMessageId: uuid,
+      dir: cwd,
+      linuxUser: getSessionLinuxUser(session) || undefined,
+    });
     if (!result || !result.sessionId) throw new Error("Fork returned no session id");
 
     // Adapters with rollbackThread (e.g. Codex) use local history copy
@@ -1471,6 +1489,7 @@ function createSDKBridge(opts) {
 
     var queryOpts = {
       cwd: cwd,
+      linuxUser: linuxUser || undefined,
       // appendSystemPrompt, NOT systemPrompt: a plain-string systemPrompt
       // REPLACES the entire Claude Code system prompt (sdk.d.ts:2096), which
       // would strip the driver session down to the two-sentence pair preset.
@@ -1840,6 +1859,13 @@ function createSDKBridge(opts) {
     var defaultVendor = adapter ? adapter.vendor : "claude";
     sm.defaultVendor = defaultVendor;
 
+    // Installation detection is independent of adapter initialization. Publish
+    // it before warmup so a new project does not render the initial empty state
+    // as if every CLI were missing while the default adapter starts up.
+    sm.installedVendors = detectInstalledVendors(linuxUser);
+    sm.availableVendors = getAvailableVendors(linuxUser);
+    sendModelInfoForVendor(defaultVendor, sm.currentModel || "");
+
     // Initialize default adapter first (provides skills, slash commands, etc.)
     if (adapter) {
       try {
@@ -1891,19 +1917,8 @@ function createSDKBridge(opts) {
     //     actually issues a query with it.
     sm.modelsByVendor = sm.modelsByVendor || {};
 
-    // Detect installed vendors per-user (binary existence check)
-    sm.installedVendors = detectInstalledVendors(linuxUser);
-    sm.availableVendors = getAvailableVendors(linuxUser);
-
-    // Send initial state to client
-    send({
-      type: "model_info",
-      model: sm.currentModel || "",
-      models: getModelsForVendor(defaultVendor),
-      vendor: defaultVendor,
-      availableVendors: sm.availableVendors,
-      installedVendors: sm.installedVendors,
-    });
+    // Send the fully initialized state to the client.
+    sendModelInfoForVendor(defaultVendor, sm.currentModel || "");
   }
 
   async function setModel(session, model) {
@@ -2017,7 +2032,7 @@ function createSDKBridge(opts) {
   // Creates a mention session that can be reused across multiple mentions
   // within a conversation flow (session continuity).
   async function createMentionSession(opts) {
-    // opts: { vendor, claudeMd, initialContext, initialMessage, onDelta, onDone, onError, onActivity }
+    // opts: { vendor, linuxUser, claudeMd, initialContext, initialMessage, onDelta, onDone, onError, onActivity }
     var abortController = new AbortController();
 
     // Current response callbacks (swapped on each pushMessage)
@@ -2037,6 +2052,7 @@ function createSDKBridge(opts) {
     try {
       handle = await mentionAdapter.createQuery({
         cwd: cwd,
+        linuxUser: opts.linuxUser || undefined,
         systemPrompt: opts.claudeMd,
         model: opts.model || undefined,
         toolServers: opts.includeMcpServers ? (mergeMcpServers(getMcpServers(), getRemoteMcpServers) || undefined) : undefined,

package/lib/yoke/adapters/codex.js

@@ -7,6 +7,7 @@ var path = require("path");
 var fs = require("fs");
 var { CodexAppServer } = require("../codex-app-server");
 var skillDiscovery = require("../skill-discovery");
+var { resolveOsUserInfo } = require("../../os-users");
 
 // --- Event flattening ---
 // Converts app-server JSON-RPC notifications into flat objects with a yokeType field.
@@ -1220,6 +1221,13 @@ function createCodexAdapter(opts) {
   var _cwd = (opts && opts.cwd) || process.cwd();
   var _slug = (opts && opts.slug) || "";
   var _defaultInitOpts = Object.assign({}, opts || {});
+  var _runtimeLinuxUser = (opts && opts.runtimeLinuxUser) || null;
+  var _requiresLinuxUser = !!(opts && opts.osUsers) && !_runtimeLinuxUser;
+  var _userRuntimes = Object.create(null);
+  var _resolveOsUserInfo = (opts && opts.resolveOsUserInfo) || resolveOsUserInfo;
+  var _createAppServer = (opts && opts.createAppServer) || function(serverOpts) {
+    return new CodexAppServer(null, serverOpts);
+  };
   // Codex models are a fixed list (the app-server doesn't enumerate them), so
   // model listing must not depend on a successful app-server init — otherwise a
   // slow/failed `initialize` leaves the picker empty and the chip shows the
@@ -1244,6 +1252,45 @@ function createCodexAdapter(opts) {
   var _shuttingDown = false;
   var _activeQueries = [];
 
+  function withoutLinuxUser(callOpts) {
+    var cleaned = Object.assign({}, callOpts || {});
+    delete cleaned.linuxUser;
+    return cleaned;
+  }
+
+  function getUserRuntime(linuxUser) {
+    if (!linuxUser) return null;
+    if (_runtimeLinuxUser) {
+      if (_runtimeLinuxUser !== linuxUser) {
+        throw new Error("Codex runtime user mismatch: expected " + _runtimeLinuxUser + ", received " + linuxUser);
+      }
+      return adapter;
+    }
+    if (!_userRuntimes[linuxUser]) {
+      var runtimeOpts = Object.assign({}, _defaultInitOpts, {
+        runtimeLinuxUser: linuxUser,
+      });
+      delete runtimeOpts.linuxUser;
+      _userRuntimes[linuxUser] = createCodexAdapter(runtimeOpts);
+    }
+    return _userRuntimes[linuxUser];
+  }
+
+  function shutdownUserRuntimes(method, idleMs) {
+    var users = Object.keys(_userRuntimes);
+    if (!users.length) return Promise.resolve([]);
+    return Promise.all(users.map(function(linuxUser) {
+      var runtime = _userRuntimes[linuxUser];
+      var result = method === "shutdownIfIdle"
+        ? runtime.shutdownIfIdle(idleMs)
+        : runtime.shutdown();
+      return Promise.resolve(result).then(function(stopped) {
+        if (method === "shutdown" || stopped) delete _userRuntimes[linuxUser];
+        return stopped;
+      });
+    }));
+  }
+
   function updateLastActiveAt() {
     _lastActiveAt = Date.now();
   }
@@ -1396,6 +1443,16 @@ function createCodexAdapter(opts) {
     vendor: "codex",
 
     init: function(initOpts) {
+      var requestedLinuxUser = initOpts && initOpts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).init(withoutLinuxUser(initOpts));
+      }
+      if (_requiresLinuxUser) {
+        return Promise.reject(new Error("Codex requires a mapped Linux user while OS-user isolation is enabled"));
+      }
+      if (_runtimeLinuxUser && requestedLinuxUser && requestedLinuxUser !== _runtimeLinuxUser) {
+        return Promise.reject(new Error("Codex runtime user mismatch"));
+      }
       if (_shuttingDown) {
         return Promise.reject(createShutdownError());
       }
@@ -1412,6 +1469,9 @@ function createCodexAdapter(opts) {
 
       _initPromise = (async function() {
         var serverOpts = { cwd: _cwd };
+        if (_runtimeLinuxUser) {
+          serverOpts.osUserInfo = _resolveOsUserInfo(_runtimeLinuxUser);
+        }
 
         // Extract adapter options
         if (effectiveInitOpts && effectiveInitOpts.adapterOptions && effectiveInitOpts.adapterOptions.CODEX) {
@@ -1478,7 +1538,7 @@ function createCodexAdapter(opts) {
         }
 
         // Spawn and initialize app-server
-        _appServer = new CodexAppServer(null, serverOpts);
+        _appServer = _createAppServer(serverOpts);
         await _appServer.start();
 
         await _appServer.send("initialize", {
@@ -1565,6 +1625,16 @@ function createCodexAdapter(opts) {
     },
 
     createQuery: async function(queryOpts) {
+      var requestedLinuxUser = queryOpts && queryOpts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).createQuery(withoutLinuxUser(queryOpts));
+      }
+      if (_requiresLinuxUser) {
+        throw new Error("Codex requires a mapped Linux user while OS-user isolation is enabled");
+      }
+      if (_runtimeLinuxUser && requestedLinuxUser && requestedLinuxUser !== _runtimeLinuxUser) {
+        throw new Error("Codex runtime user mismatch");
+      }
       if (_shuttingDown) {
         throw createShutdownError();
       }
@@ -1661,6 +1731,13 @@ function createCodexAdapter(opts) {
 
     // --- Title generation ---
     generateTitle: async function(messages, opts) {
+      var requestedLinuxUser = opts && opts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).generateTitle(messages, withoutLinuxUser(opts));
+      }
+      if (_requiresLinuxUser) {
+        throw new Error("Codex requires a mapped Linux user while OS-user isolation is enabled");
+      }
       var systemPrompt = "You are a title generator. Output only a short title (3-8 words). No quotes, no punctuation at the end, no explanation.";
       var prompt = "Below is a conversation between a user and an AI assistant. Generate a short, descriptive title (3-8 words) that captures the main topic. Reply with ONLY the title, nothing else.\n\n";
       for (var i = 0; i < messages.length; i++) {
@@ -1708,6 +1785,11 @@ function createCodexAdapter(opts) {
     listSessions: function() { return Promise.resolve([]); },
     renameSession: function() { return Promise.resolve(); },
     forkSession: function(threadId, opts) {
+      var requestedLinuxUser = opts && opts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).forkSession(threadId, withoutLinuxUser(opts));
+      }
+      if (_requiresLinuxUser) return Promise.reject(new Error("Codex requires a mapped Linux user while OS-user isolation is enabled"));
       if (!_appServer || !_appServer.started) return Promise.resolve(null);
       return _appServer.send("thread/fork", { threadId: threadId }, 30000).then(function(result) {
         var newThreadId = (result && result.thread) ? result.thread.id : null;
@@ -1715,17 +1797,30 @@ function createCodexAdapter(opts) {
         return { sessionId: newThreadId };
       });
     },
-    rollbackThread: function(threadId, numTurns) {
+    rollbackThread: function(threadId, numTurns, opts) {
+      var requestedLinuxUser = opts && opts.linuxUser;
+      if (!_runtimeLinuxUser && requestedLinuxUser) {
+        return getUserRuntime(requestedLinuxUser).rollbackThread(threadId, numTurns, withoutLinuxUser(opts));
+      }
+      if (_requiresLinuxUser) return Promise.reject(new Error("Codex requires a mapped Linux user while OS-user isolation is enabled"));
       if (!_appServer || !_appServer.started) return Promise.resolve(null);
       return _appServer.send("thread/rollback", { threadId: threadId, numTurns: numTurns }, 30000);
     },
 
     // Shutdown the app-server process
     shutdown: function() {
-      return beginShutdown(true);
+      return Promise.all([
+        beginShutdown(true),
+        shutdownUserRuntimes("shutdown"),
+      ]).then(function() { return true; });
     },
 
     shutdownIfIdle: function(idleMs) {
+      if (!_runtimeLinuxUser && Object.keys(_userRuntimes).length > 0) {
+        return shutdownUserRuntimes("shutdownIfIdle", idleMs).then(function(results) {
+          return results.some(function(stopped) { return !!stopped; });
+        });
+      }
       if (_shuttingDown || _shutdownPromise) return Promise.resolve(false);
       if (_initPromise) return Promise.resolve(false);
       if (!_appServer) return Promise.resolve(false);

package/lib/yoke/codex-app-server.js

@@ -9,6 +9,8 @@ var readline = require("readline");
 var path = require("path");
 var fs = require("fs");
 var { createRequire } = require("module");
+var { buildUserEnv } = require("../build-user-env");
+var { wrapSpawnAsUser } = require("../os-users");
 
 // --- Find the codex binary path ---
 // Mirrors the logic from @openai/codex-sdk findCodexPath()
@@ -120,14 +122,30 @@ function CodexAppServer(executablePath, opts) {
   this._stderrBuf = "";
 }
 
+function buildSpawnSpec(executablePath, args, opts, wrapFn) {
+  opts = opts || {};
+  var osUserInfo = opts.osUserInfo || null;
+  var env = osUserInfo
+    ? Object.assign(buildUserEnv(osUserInfo), opts.env || {})
+    : Object.assign({}, process.env, opts.env || {});
+  var spawnOptions = {
+    stdio: ["pipe", "pipe", "pipe"],
+    env: env,
+    cwd: opts.cwd || process.cwd(),
+  };
+  if (osUserInfo) {
+    spawnOptions.uid = osUserInfo.uid;
+    spawnOptions.gid = osUserInfo.gid;
+  }
+  return (wrapFn || wrapSpawnAsUser)(executablePath, args, spawnOptions);
+}
+
 CodexAppServer.prototype.start = function() {
   var self = this;
 
   return new Promise(function(resolve, reject) {
     try {
       var args = ["app-server"];
-      var env = Object.assign({}, process.env, self.opts.env || {});
-
       // Pass config overrides via --config key=value flags
       if (self.opts.config) {
         var configArgs = serializeConfig(self.opts.config, "");
@@ -136,13 +154,11 @@ CodexAppServer.prototype.start = function() {
         }
       }
 
-      console.log("[codex-app-server] Spawning:", self.executablePath, args.join(" "));
+      var spawnSpec = buildSpawnSpec(self.executablePath, args, self.opts);
+      var userSuffix = self.opts.osUserInfo ? " as " + self.opts.osUserInfo.user : "";
+      console.log("[codex-app-server] Spawning" + userSuffix + ":", spawnSpec.command, spawnSpec.args.join(" "));
 
-      self.proc = spawn(self.executablePath, args, {
-        stdio: ["pipe", "pipe", "pipe"],
-        env: env,
-        cwd: self.opts.cwd || process.cwd(),
-      });
+      self.proc = spawn(spawnSpec.command, spawnSpec.args, spawnSpec.options);
 
       self.proc.on("error", function(err) {
         console.error("[codex-app-server] Process error:", err.message);
@@ -383,4 +399,5 @@ CodexAppServer.prototype.stop = function() {
 module.exports = {
   CodexAppServer: CodexAppServer,
   findCodexPath: findCodexPath,
+  buildSpawnSpec: buildSpawnSpec,
 };

package/lib/yoke/index.js

@@ -350,7 +350,7 @@ function createAdapters(opts) {
 
   if (installed.codex && supportsConfiguredIsolation("codex")) {
     try {
-      adapters.codex = createAdapter({ vendor: "codex", cwd: opts.cwd, slug: opts.slug });
+      adapters.codex = createAdapter({ vendor: "codex", cwd: opts.cwd, slug: opts.slug, osUsers: !!opts.osUsers });
       auth.codex = true;
       console.log("[yoke] Adapter created: codex");
     } catch (e) {
@@ -411,7 +411,12 @@ async function lazyCreateAdapter(adapters, vendor, opts) {
   if (!installed[vendor]) return null;
 
   try {
-    var ad = createAdapter({ vendor: vendor, cwd: opts.cwd, slug: opts.slug });
+    var ad = createAdapter({
+      vendor: vendor,
+      cwd: opts.cwd,
+      slug: opts.slug,
+      osUsers: !!(opts.osUsers || opts.linuxUser),
+    });
     if (typeof ad.init === "function") {
       await ad.init(opts || {});
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "3.4.0-beta.4",
+  "version": "3.4.0-beta.6",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",