clay-server 3.5.1 → 3.6.0-beta.2

package/lib/os-user-diagnostics.js

@@ -0,0 +1,312 @@
+// Best-effort, read-only diagnostics for the current OS-user compatibility mode.
+
+var fs = require("fs");
+var childProcess = require("child_process");
+var path = require("path");
+var execFileSync = childProcess.execFileSync;
+var osUsers = require("./os-users");
+
+function commandAvailable(command, execFile) {
+  try {
+    execFile(command, ["--help"], { stdio: "ignore", timeout: 5000 });
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
+
+function credentialPaths(home) {
+  if (!home) return [];
+  return [
+    home + "/.claude",
+    home + "/.codex",
+    home + "/.config/gh",
+    home + "/.config/gcloud",
+  ];
+}
+
+function accessStatus(checks) {
+  var names = ["read", "traverse", "write"];
+  for (var i = 0; i < names.length; i++) {
+    if (!checks[names[i]] || checks[names[i]].status === "unknown") return "unknown";
+  }
+  for (var j = 0; j < names.length; j++) {
+    if (checks[names[j]].status === "deny") return "deny";
+  }
+  return "allow";
+}
+
+function unknownChecks() {
+  return {
+    read: { status: "unknown" },
+    traverse: { status: "unknown" },
+    write: { status: "unknown" },
+  };
+}
+
+function projectAccessScript(projectPath) {
+  return [
+    "var fs = require('fs');",
+    "var target = " + JSON.stringify(projectPath) + ";",
+    "var checks = {};",
+    "function check(name, mode) {",
+    "  try { fs.accessSync(target, mode); checks[name] = { status: 'allow' }; }",
+    "  catch (error) { checks[name] = { status: 'deny', code: String(error && error.code || 'EACCES') }; }",
+    "}",
+    "check('read', fs.constants.R_OK);",
+    "check('traverse', fs.constants.X_OK);",
+    "check('write', fs.constants.W_OK);",
+    "process.stdout.write(JSON.stringify(checks));",
+  ].join(" ");
+}
+
+/**
+ * Check directory access as the mapped identity without creating or changing
+ * any file. The spawn wrapper intentionally follows the runtime's current
+ * supplementary-group behavior, including its setpriv fallback.
+ */
+function probeMappedProjectAccess(project, user, options) {
+  options = options || {};
+  var result = {
+    projectSlug: project && project.slug || null,
+    userId: user && user.id || null,
+    result: "unknown",
+    checks: unknownChecks(),
+  };
+  if (!project || !project.path) {
+    result.evidence = "project_path_unavailable";
+    return result;
+  }
+  if (!user || !user.linuxUser) {
+    result.evidence = "linux_mapping_missing";
+    return result;
+  }
+
+  var resolveUser = options.resolveUser || osUsers.resolveOsUserInfo;
+  var wrapSpawn = options.wrapSpawn || osUsers.wrapSpawnAsUser;
+  var execFile = options.execFile || execFileSync;
+  var nodePath = options.nodePath || process.execPath;
+  var account;
+  try {
+    account = resolveUser(user.linuxUser);
+  } catch (e) {
+    result.evidence = "linux_account_unavailable";
+    return result;
+  }
+  if (!account || account.uid == null || account.gid == null) {
+    result.evidence = "linux_account_invalid";
+    return result;
+  }
+
+  try {
+    var spawn = wrapSpawn(nodePath, ["-e", projectAccessScript(project.path)], {
+      encoding: "utf8",
+      timeout: 5000,
+      stdio: "pipe",
+      uid: account.uid,
+      gid: account.gid,
+    }, options.setprivCheck);
+    var output = execFile(spawn.command, spawn.args, spawn.options);
+    var checks = JSON.parse(String(output).trim());
+    if (!checks || typeof checks !== "object") throw new Error("Invalid access probe result");
+    result.checks = checks;
+    result.result = accessStatus(checks);
+    result.evidence = "mapped_identity_access";
+  } catch (e) {
+    result.evidence = "probe_unavailable";
+  }
+  return result;
+}
+
+function collectUserDiagnostics(user, options) {
+  options = options || {};
+  var resolveUser = options.resolveUser || osUsers.resolveOsUserInfo;
+  var exists = options.exists || fs.existsSync;
+  var execFile = options.execFile || execFileSync;
+  var result = {
+    userId: user && user.id || null,
+    linuxUser: user && user.linuxUser || null,
+    mapping: "missing",
+    account: "unknown",
+    supplementaryGroups: "unknown",
+    credentialPaths: [],
+  };
+  if (!user || !user.linuxUser) return result;
+
+  var account;
+  try {
+    account = resolveUser(user.linuxUser);
+    result.mapping = "resolved";
+    result.account = "present";
+  } catch (e) {
+    result.mapping = "unavailable";
+    result.account = "missing";
+    result.evidence = "linux_account_unavailable";
+    return result;
+  }
+
+  try {
+    var output = execFile("id", ["-Gn", user.linuxUser], { encoding: "utf8", timeout: 5000, stdio: "pipe" });
+    result.supplementaryGroups = output.trim() ? output.trim().split(/\s+/) : [];
+  } catch (e) {
+    result.supplementaryGroups = "unknown";
+  }
+  var paths = credentialPaths(account.home);
+  for (var i = 0; i < paths.length; i++) {
+    var present = "unknown";
+    try { present = !!exists(paths[i]); } catch (e) {}
+    result.credentialPaths.push({ path: paths[i], present: present });
+  }
+  return result;
+}
+
+function collectOsUserDiagnostics(options) {
+  options = options || {};
+  var users = options.users || [];
+  var projects = options.projects || [];
+  var probeProjectAccess = options.probeProjectAccess || probeMappedProjectAccess;
+  var execFile = options.execFile || execFileSync;
+  var result = {
+    collectedAt: Date.now(),
+    setprivAvailable: commandAvailable("setpriv", execFile),
+    users: [],
+    projectAccess: [],
+  };
+  for (var i = 0; i < users.length; i++) {
+    try {
+      result.users.push(collectUserDiagnostics(users[i], options));
+    } catch (e) {
+      result.users.push({
+        userId: users[i] && users[i].id || null,
+        linuxUser: users[i] && users[i].linuxUser || null,
+        mapping: "unknown",
+        account: "unknown",
+        supplementaryGroups: "unknown",
+        credentialPaths: [],
+      });
+    }
+  }
+  for (var pi = 0; pi < projects.length; pi++) {
+    var project = projects[pi];
+    for (var ui = 0; ui < users.length; ui++) {
+      var user = users[ui];
+      if (!project || !user) continue;
+      var probe;
+      try {
+        probe = probeProjectAccess(project, user, options);
+        if (!probe || typeof probe !== "object") probe = { result: "unknown", evidence: "invalid_probe_result" };
+      } catch (e) {
+        probe = { result: "unknown", evidence: "probe_failed" };
+      }
+      if (!probe.projectSlug) probe.projectSlug = project.slug || null;
+      if (!probe.userId) probe.userId = user.id || null;
+      if (!probe.result) probe.result = "unknown";
+      result.projectAccess.push(probe);
+    }
+  }
+  return result;
+}
+
+function summarizeDiagnostics(result) {
+  var users = result.users || [];
+  var projectAccess = result.projectAccess || [];
+  var unavailableMappings = 0;
+  var unknownProbes = 0;
+  for (var i = 0; i < users.length; i++) {
+    if (users[i].mapping !== "resolved") unavailableMappings++;
+  }
+  for (var j = 0; j < projectAccess.length; j++) {
+    if (projectAccess[j].result === "unknown") unknownProbes++;
+  }
+  return "OS-user diagnostics: " + users.length + " user mappings, " + unavailableMappings + " unavailable, " + projectAccess.length + " project probes, " + unknownProbes + " unavailable";
+}
+
+function diagnosticsPayload(options) {
+  var users = typeof options.getUsers === "function" ? options.getUsers() : options.users || [];
+  var projects = typeof options.getProjects === "function" ? options.getProjects() : options.projects || [];
+  return {
+    users: users.map(function(user) {
+      return { id: user && user.id || null, linuxUser: user && user.linuxUser || null };
+    }),
+    projects: projects.map(function(project) {
+      return { slug: project && project.slug || null, path: project && project.path || null };
+    }),
+  };
+}
+
+function logDiagnosticMessage(logger, level, message) {
+  try {
+    if (logger && typeof logger[level] === "function") logger[level]("[daemon] " + message);
+  } catch (e) {}
+}
+
+/**
+ * Run blocking host probes in a short-lived child so diagnostics cannot stall
+ * the daemon event loop after it starts serving requests.
+ */
+function scheduleOsUserDiagnosticsAsync(options) {
+  options = options || {};
+  var schedule = options.schedule || setTimeout;
+  var clearSchedule = options.clearSchedule || clearTimeout;
+  var spawn = options.spawn || childProcess.spawn;
+  var logger = options.logger || console;
+  var timeoutMs = options.timeoutMs || 30000;
+  try {
+    schedule(function() {
+      var child;
+      var timeout;
+      var output = "";
+      var completed = false;
+      function finish(level, message) {
+        if (completed) return;
+        completed = true;
+        if (timeout) clearSchedule(timeout);
+        logDiagnosticMessage(logger, level, message);
+      }
+      try {
+        child = spawn(options.nodePath || process.execPath, [path.join(__dirname, "os-user-diagnostics-worker.js")], {
+          stdio: ["pipe", "pipe", "ignore"],
+        });
+        if (!child || !child.stdin || !child.stdout || typeof child.once !== "function") {
+          finish("warn", "OS-user diagnostics unavailable");
+          return;
+        }
+        child.stdout.on("data", function(chunk) { output += String(chunk); });
+        child.once("error", function() { finish("warn", "OS-user diagnostics unavailable"); });
+        child.once("close", function(code) {
+          if (completed) return;
+          if (code !== 0) {
+            finish("warn", "OS-user diagnostics unavailable");
+            return;
+          }
+          try {
+            var report = JSON.parse(output);
+            if (!report || typeof report.summary !== "string") throw new Error("Invalid diagnostics report");
+            finish("log", report.summary);
+          } catch (e) {
+            finish("warn", "OS-user diagnostics unavailable");
+          }
+        });
+        timeout = schedule(function() {
+          try { child.kill(); } catch (e) {}
+          finish("warn", "OS-user diagnostics timed out");
+        }, timeoutMs);
+        child.stdin.end(JSON.stringify(diagnosticsPayload(options)));
+      } catch (e) {
+        try { if (child && typeof child.kill === "function") child.kill(); } catch (killError) {}
+        finish("warn", "OS-user diagnostics unavailable");
+      }
+    }, 0);
+  } catch (e) {
+    logDiagnosticMessage(logger, "warn", "OS-user diagnostics could not be scheduled");
+  }
+}
+
+module.exports = {
+  collectOsUserDiagnostics: collectOsUserDiagnostics,
+  collectUserDiagnostics: collectUserDiagnostics,
+  credentialPaths: credentialPaths,
+  probeMappedProjectAccess: probeMappedProjectAccess,
+  scheduleOsUserDiagnosticsAsync: scheduleOsUserDiagnosticsAsync,
+  summarizeDiagnostics: summarizeDiagnostics,
+};

package/lib/os-users.js

@@ -54,14 +54,15 @@ function setprivAvailable() {
  *   Node's uid/gid options (primary group only) so behavior degrades safely.
  * Requires the parent process to be root, which is the case in os-users mode.
  */
-function wrapSpawnAsUser(command, args, options) {
+function wrapSpawnAsUser(command, args, options, setprivCheck) {
   args = args || [];
   options = options || {};
   var uid = options.uid;
   var gid = options.gid;
   if (uid == null || gid == null) return { command: command, args: args, options: options };
 
-  if (_inheritGroups && setprivAvailable()) {
+  var hasSetpriv = typeof setprivCheck === "function" ? setprivCheck() : setprivAvailable();
+  if (_inheritGroups && hasSetpriv) {
     var wrappedArgs = ["--reuid", String(uid), "--regid", String(gid), "--init-groups", "--", command].concat(args);
     var newOpts = Object.assign({}, options);
     delete newOpts.uid;
@@ -348,6 +349,39 @@ function toLinuxUsername(clayUsername) {
   return name;
 }
 
+function findAvailableLinuxUsername(baseName, existsFn, rejectedCandidates) {
+  var exists = existsFn || linuxUserExists;
+  rejectedCandidates = rejectedCandidates || Object.create(null);
+  if (!exists(baseName) && !rejectedCandidates[baseName]) return baseName;
+  for (var suffixNumber = 2; suffixNumber < 10000; suffixNumber++) {
+    var suffix = "-" + suffixNumber;
+    var candidate = baseName.substring(0, 32 - suffix.length).replace(/-+$/, "") + suffix;
+    if (!exists(candidate) && !rejectedCandidates[candidate]) return candidate;
+  }
+  throw new Error("Could not allocate a unique Linux username for " + baseName);
+}
+
+function allocateLinuxUsername(baseName, existsFn, createUser) {
+  var exists = existsFn || linuxUserExists;
+  var rejectedCandidates = Object.create(null);
+  for (var attempt = 0; attempt < 9999; attempt++) {
+    var linuxName = findAvailableLinuxUsername(baseName, exists, rejectedCandidates);
+    try {
+      createUser(linuxName);
+      return linuxName;
+    } catch (e) {
+      var msg = (e.stderr || e.message || "").trim();
+      if (exists(linuxName) || e.status === 9 || /already exists/i.test(msg)) {
+        // NSS can lag a successful concurrent useradd, so remember collisions locally.
+        rejectedCandidates[linuxName] = true;
+        continue;
+      }
+      throw e;
+    }
+  }
+  throw new Error("Could not allocate a unique Linux username for " + baseName);
+}
+
 /**
  * Ensure linger is enabled for a Linux user so systemd creates /run/user/<uid>.
  * Required for CLI tools like gcloud and gh that need XDG_RUNTIME_DIR.
@@ -484,31 +518,28 @@ function installClaudeCli(linuxName) {
  * Returns { ok: true, linuxUser: "clay-xxx" } or { error: "..." }.
  */
 function provisionLinuxUser(clayUsername) {
-  var linuxName = toLinuxUsername(clayUsername);
-
-  // Handle name collisions by appending a number
-  if (linuxUserExists(linuxName)) {
-    // Check if this is a clay-managed user (reuse it)
-    // Otherwise find an available name
-    console.log("[os-users] Linux user " + linuxName + " already exists, reusing.");
-    return { ok: true, linuxUser: linuxName };
-  }
-
+  var baseName = toLinuxUsername(clayUsername);
+  var linuxName;
   try {
-    execFileSync("useradd", ["-m", "-s", "/bin/bash", linuxName], {
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: "pipe",
+    linuxName = allocateLinuxUsername(baseName, linuxUserExists, function(candidate) {
+      execFileSync("useradd", ["-m", "-s", "/bin/bash", candidate], {
+        encoding: "utf8",
+        timeout: 15000,
+        stdio: "pipe",
+      });
     });
-    ensureLinger(linuxName);
-    console.log("[os-users] Provisioned Linux user: " + linuxName + " (Clay user: " + clayUsername + ")");
-    installClaudeCli(linuxName);
-    return { ok: true, linuxUser: linuxName };
   } catch (e) {
     var msg = (e.stderr || e.message || "").trim();
-    console.error("[os-users] Failed to provision Linux user " + linuxName + ": " + msg);
-    return { error: "Failed to create Linux user " + linuxName + ": " + msg };
+    console.error("[os-users] Failed to provision Linux user " + baseName + ": " + msg);
+    return { error: "Failed to create Linux user " + baseName + ": " + msg };
+  }
+  if (linuxName !== baseName) {
+    console.log("[os-users] Linux user " + baseName + " already exists; provisioning " + linuxName + " instead");
   }
+  ensureLinger(linuxName);
+  console.log("[os-users] Provisioned Linux user: " + linuxName + " (Clay user: " + clayUsername + ")");
+  installClaudeCli(linuxName);
+  return { ok: true, linuxUser: linuxName };
 }
 
 /**
@@ -627,4 +658,6 @@ module.exports = {
   getLinuxUserHome: getLinuxUserHome,
   getLinuxUserUid: getLinuxUserUid,
   isSafeLinuxUsername: isSafeLinuxUsername,
+  findAvailableLinuxUsername: findAvailableLinuxUsername,
+  allocateLinuxUsername: allocateLinuxUsername,
 };

package/lib/pages.js

@@ -3,9 +3,9 @@ function pinPageHtml() {
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
     '<meta name="mobile-web-app-capable" content="yes">' +
-    '<link rel="icon" type="image/png" href="/favicon-banded.png">' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
     '<link rel="apple-touch-icon" href="/apple-touch-icon.png">' +
-    '<title>Clay</title>' +
+    '<title>Clay Studio</title>' +
     '<style>' + authPageStyles + '</style></head><body><div class="c">' +
     '<h1 id="greeting"></h1>' +
     '<div class="sub">Enter your PIN to continue</div>' +
@@ -44,9 +44,10 @@ function setupPageHtml(httpsUrl, httpUrl, hasCert, lanMode) {
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
 <meta name="apple-mobile-web-app-capable" content="yes">
+<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">
 <link rel="manifest" href="/manifest.json">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
-<title>Setup - Clay</title>
+<title>Setup - Clay Studio</title>
 <style>
 :root{--s-bg:#282a36;--s-text:#f8f8f2;--s-accent:#ffb86c;--s-muted:#6272a4;--s-border:#44475a;--s-dimmer:#6272a4;--s-success:#50fa7b;--s-accent-15:rgba(255,184,108,0.15);--s-success-10:rgba(80,250,123,0.1);--s-success-15:rgba(80,250,123,0.15);--s-accent-06:rgba(255,184,108,0.06);--s-muted-06:rgba(98,114,164,0.06);--s-muted-15:rgba(98,114,164,0.15)}
 @media(prefers-color-scheme:light){:root{--s-bg:#FAFAFA;--s-text:#5C6166;--s-accent:#FA8D3E;--s-muted:#A0A6AC;--s-border:#D2D4D8;--s-dimmer:#8A9199;--s-success:#6CBF49;--s-accent-15:rgba(250,141,62,0.15);--s-success-10:rgba(108,191,73,0.1);--s-success-15:rgba(108,191,73,0.15);--s-accent-06:rgba(250,141,62,0.06);--s-muted-06:rgba(160,166,172,0.06);--s-muted-15:rgba(160,166,172,0.15)}}
@@ -662,9 +663,10 @@ function escapeHtml(s) {
   return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
-// --- Build auth page CSS variables from ayu-light theme (same logic as theme.js computeVars) ---
+// --- Build auth page CSS variables from the Clay Studio theme pair ---
 var path = require("path");
-var _authTheme = require(path.join(__dirname, "themes", "ayu-light.json"));
+var _authTheme = require(path.join(__dirname, "themes", "clay-light.json"));
+var _authDarkTheme = require(path.join(__dirname, "themes", "clay-dark.json"));
 
 function _hexToRgb(hex) {
   hex = hex.replace("#", "");
@@ -689,35 +691,39 @@ function _mixColors(hex1, hex2, weight) {
   return "#" + ((1 << 24) + (r << 16) + (g << 8) + b).toString(16).slice(1);
 }
 
-var _t = {};
 var _keys = ["base00","base01","base02","base03","base04","base05","base06","base07",
              "base08","base09","base0A","base0B","base0C","base0D","base0E","base0F"];
-for (var _ki = 0; _ki < _keys.length; _ki++) {
-  _t[_keys[_ki]] = "#" + _authTheme[_keys[_ki]];
-}
-
-var _authVarsObj = {
-  "--bg": _t.base00,
-  "--bg-alt": _t.base01,
-  "--text": _t.base06,
-  "--text-muted": _t.base04,
-  "--text-dimmer": _t.base03,
-  "--accent": _t.base09,
-  "--accent-15": _hexToRgba(_t.base09, 0.15),
-  "--accent-20": _hexToRgba(_t.base09, 0.20),
-  "--border": _t.base02,
-  "--input-bg": _mixColors(_t.base01, _t.base02, 0.5),
-  "--error": _t.base08,
-};
 
-var _authVarsStr = ":root{";
-var _avKeys = Object.keys(_authVarsObj);
-for (var _vi = 0; _vi < _avKeys.length; _vi++) {
-  _authVarsStr += _avKeys[_vi] + ":" + _authVarsObj[_avKeys[_vi]] + ";";
+function _buildAuthVarDeclarations(theme) {
+  var t = {};
+  for (var ki = 0; ki < _keys.length; ki++) {
+    t[_keys[ki]] = "#" + theme[_keys[ki]];
+  }
+  var vars = {
+    "--bg": t.base00,
+    "--bg-alt": t.base01,
+    "--text": t.base06,
+    "--text-muted": t.base04,
+    "--text-dimmer": t.base03,
+    "--accent": t.base09,
+    "--accent-15": _hexToRgba(t.base09, 0.15),
+    "--accent-20": _hexToRgba(t.base09, 0.20),
+    "--border": t.base02,
+    "--input-bg": _mixColors(t.base01, t.base02, 0.5),
+    "--error": t.base08,
+  };
+  var declarations = "";
+  var names = Object.keys(vars);
+  for (var vi = 0; vi < names.length; vi++) {
+    declarations += names[vi] + ":" + vars[names[vi]] + ";";
+  }
+  return declarations;
 }
-_authVarsStr += "}";
 
-// --- Shared CSS for auth pages (Clay Light theme via CSS variables) ---
+var _authVarsStr = ":root{" + _buildAuthVarDeclarations(_authTheme) + "}" +
+  "@media(prefers-color-scheme:dark){:root{" + _buildAuthVarDeclarations(_authDarkTheme) + "}}";
+
+// --- Shared CSS for auth pages ---
 var authPageStyles =
   _authVarsStr +
   // Reset & layout
@@ -806,7 +812,8 @@ function adminSetupPageHtml() {
   return '<!DOCTYPE html><html lang="en"><head>' +
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
-    '<title>Admin Setup - Clay</title>' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
+    '<title>Admin Setup - Clay Studio</title>' +
     '<style>' + authPageStyles + '</style></head><body><div class="c">' +
     '<div class="steps-bar"><span class="steps-dot current" id="dot0"></span><span class="steps-dot" id="dot1"></span><span class="steps-dot" id="dot2"></span><span class="steps-dot" id="dot3"></span></div>' +
 
@@ -901,7 +908,8 @@ function multiUserLoginPageHtml() {
   return '<!DOCTYPE html><html lang="en"><head>' +
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
-    '<title>Login - Clay</title>' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
+    '<title>Login - Clay Studio</title>' +
     '<style>' + authPageStyles + '</style></head><body><div class="c">' +
     '<div class="steps-bar"><span class="steps-dot current" id="dot0"></span><span class="steps-dot" id="dot1"></span></div>' +
 
@@ -986,7 +994,8 @@ function invitePageHtml(inviteCode) {
   return '<!DOCTYPE html><html lang="en"><head>' +
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
-    '<title>Join - Clay</title>' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
+    '<title>Join - Clay Studio</title>' +
     '<style>' + authPageStyles + '</style></head><body><div class="c">' +
     '<div class="steps-bar"><span class="steps-dot current" id="dot0"></span><span class="steps-dot" id="dot1"></span><span class="steps-dot" id="dot2"></span></div>' +
 
@@ -1067,7 +1076,8 @@ function smtpLoginPageHtml() {
   return '<!DOCTYPE html><html lang="en"><head>' +
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
-    '<title>Login - Clay</title>' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
+    '<title>Login - Clay Studio</title>' +
     '<style>' + authPageStyles +
     '.otp-input{width:100%;font-size:24px;letter-spacing:8px;text-align:center;padding:12px;' +
     'background:var(--field-bg);border:1px solid var(--field-border);border-radius:8px;color:var(--fg);' +
@@ -1223,7 +1233,8 @@ function smtpInvitePageHtml(inviteCode) {
   return '<!DOCTYPE html><html lang="en"><head>' +
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
-    '<title>Join - Clay</title>' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
+    '<title>Join - Clay Studio</title>' +
     '<style>' + authPageStyles + '</style></head><body><div class="c">' +
     '<div class="steps-bar"><span class="steps-dot current" id="dot0"></span><span class="steps-dot" id="dot1"></span><span class="steps-dot" id="dot2"></span></div>' +
 
@@ -1311,7 +1322,8 @@ function noProjectsPageHtml() {
   return '<!DOCTYPE html><html lang="en"><head>' +
     '<meta charset="UTF-8">' +
     '<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">' +
-    '<title>Clay</title>' +
+    '<link rel="icon" type="image/png" sizes="32x32" href="/clay-studio-favicon-32.png">' +
+    '<title>Clay Studio</title>' +
     '<style>' + authPageStyles + '</style></head><body><div class="c">' +
     '<h1>Hang tight!</h1>' +
     '<div class="sub">No projects have been assigned to your account yet.</div>' +

package/lib/public/app.js

@@ -31,12 +31,11 @@ import { initContextSources, updateTerminalList, updateBrowserTabList, handleCon
 import { initStickyNotes, handleNotesList, handleNoteCreated, handleNoteUpdated, handleNoteDeleted, openArchive, closeArchive, isArchiveOpen, hideNotes, showNotes, isNotesVisible, createNote } from './modules/sticky-notes.js';
 import { initTheme, getThemeColor, getComputedVar, onThemeChange, getCurrentTheme, getChatLayout } from './modules/theme.js';
 import { initTools, resetToolState, saveToolState, restoreToolState, renderAskUserQuestion, markAskUserAnswered, renderPermissionRequest, markPermissionResolved, markPermissionCancelled, renderElicitationRequest, markElicitationResolved, renderPlanBanner, renderPlanCard, handleTodoWrite, handleTaskCreate, handleTaskUpdate, startThinking, appendThinking, stopThinking, resetThinkingGroup, createToolItem, updateToolExecuting, updateToolResult, markAllToolsDone, addTurnMeta, resetTurnMetaCost, enableMainInput, getTools, getPlanContent, setPlanContent, isPlanFilePath, getTodoTools, updateSubagentActivity, addSubagentToolEntry, markSubagentDone, updateSubagentProgress, initSubagentStop, closeToolGroup, removeToolFromGroup } from './modules/tools.js';
-import { initServerSettings, updateSettingsStats, updateSettingsModels, updateDaemonConfig, handleSetPinResult, handleKeepAwakeChanged, handleAutoContinueChanged, handleRestartResult, handleShutdownResult, handleSharedEnv, handleSharedEnvSaved, handleGlobalClaudeMdRead, handleGlobalClaudeMdWrite } from './modules/server-settings.js';
+import { initServerSettings, updateSettingsStats, updateDaemonConfig, handleSetPinResult, handleKeepAwakeChanged, handleAutoContinueChanged, handleRestartResult, handleShutdownResult, handleSharedEnv, handleSharedEnvSaved, handleGlobalClaudeMdRead, handleGlobalClaudeMdWrite } from './modules/server-settings.js';
 import { initProjectSettings, handleInstructionsRead, handleInstructionsWrite, handleProjectEnv, handleProjectEnvSaved, isProjectSettingsOpen, handleProjectSharedEnv, handleProjectSharedEnvSaved, handleProjectOwnerChanged } from './modules/project-settings.js';
 import { initSkills, handleSkillInstalled, handleSkillUninstalled } from './modules/skills.js';
 import { initMcp } from './modules/mcp-ui.js';
 import { initScheduler, resetScheduler, handleLoopRegistryUpdated, handleScheduleRunStarted, handleScheduleRunFinished, handleLoopScheduled, openSchedulerToTab, isSchedulerOpen, closeScheduler, enterCraftingMode, exitCraftingMode, handleLoopRegistryFiles, getUpcomingSchedules } from './modules/scheduler.js';
-import { initAsciiLogo, startLogoAnimation, stopLogoAnimation } from './modules/ascii-logo.js';
 import { initPlaybook, openPlaybook, getPlaybooks, getPlaybookForTip, isCompleted as isPlaybookCompleted } from './modules/playbook.js';
 import { initSTT } from './modules/stt.js';
 import { initProfile, getProfileLang } from './modules/profile.js';
@@ -58,7 +57,7 @@ import { getWs as _getWsRef, setWs as _setWsRef } from './modules/ws-ref.js';
 import { initHomeHub, showHomeHub as _hubShowHomeHub, hideHomeHub as _hubHideHomeHub, handleHubSchedules as _hubHandleHubSchedules, renderHomeHub as _hubRenderHomeHub, isHomeHubVisible } from './modules/app-home-hub.js';
 import { initRateLimit, handleRateLimitEvent as _rlHandleRateLimitEvent, updateRateLimitUsage as _rlUpdateRateLimitUsage, addScheduledMessageBubble as _rlAddScheduledMessageBubble, removeScheduledMessageBubble as _rlRemoveScheduledMessageBubble, handleFastModeState as _rlHandleFastModeState, getScheduledMsgEl, resetRateLimitState } from './modules/app-rate-limit.js';
 import { initCursors, handleRemoteCursorMove as _curHandleRemoteCursorMove, handleRemoteCursorLeave as _curHandleRemoteCursorLeave, handleRemoteSelection as _curHandleRemoteSelection, clearRemoteCursors as _curClearRemoteCursors, initCursorToggle } from './modules/app-cursors.js';
-import { initFavicon, updateFavicon as _favUpdateFavicon, setSendBtnMode as _favSetSendBtnMode, blinkIO as _favBlinkIO, blinkSessionDot as _favBlinkSessionDot, updateCrossProjectBlink as _favUpdateCrossProjectBlink, startUrgentBlink as _favStartUrgentBlink, stopUrgentBlink as _favStopUrgentBlink, setActivity as _favSetActivity, drawFaviconAnimFrame as _favDrawFaviconAnimFrame } from './modules/app-favicon.js';
+import { initFavicon, updateFavicon as _favUpdateFavicon, setSendBtnMode as _favSetSendBtnMode, blinkIO as _favBlinkIO, blinkSessionDot as _favBlinkSessionDot, updateCrossProjectBlink as _favUpdateCrossProjectBlink, startUrgentBlink as _favStartUrgentBlink, stopUrgentBlink as _favStopUrgentBlink, setActivity as _favSetActivity } from './modules/app-favicon.js';
 import { initHeader, closeSessionInfoPopover as _hdrCloseSessionInfoPopover, updateHistorySentinel as _hdrUpdateHistorySentinel, requestMoreHistory as _hdrRequestMoreHistory, prependOlderHistory as _hdrPrependOlderHistory } from './modules/app-header.js';
 import { initSessionActions } from './modules/session-actions.js';
 import { initMisc, flushPendingExtMessages, showImageModal as _miscShowImageModal, closeImageModal as _miscCloseImageModal, showPasteModal as _miscShowPasteModal, closePasteModal as _miscClosePasteModal, showConfirm as _miscShowConfirm, hideConfirm as _miscHideConfirm, showForceChangePinOverlay as _miscShowForceChangePinOverlay, sendExtensionCommand as _miscSendExtensionCommand, handleExtensionResult as _miscHandleExtensionResult } from './modules/app-misc.js';
@@ -504,13 +503,6 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
   initSplitView();
   initPaneBridge();
 
-  // --- Connect overlay (animated ASCII logo) ---
-  var asciiLogoCanvas = $("ascii-logo-canvas");
-  initAsciiLogo(asciiLogoCanvas);
-  startLogoAnimation();
-  function startVerbCycle() { startLogoAnimation(); }
-  function stopVerbCycle() { stopLogoAnimation(); }
-
   // --- Favicon, IO blink, status/activity -> modules/app-favicon.js
   function startPixelAnim() {}
   function stopPixelAnim() {}

package/lib/public/clay-studio-wordmark.svg

@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 4611 1531" role="img" aria-label="Clay Studio">
+  <title>Clay Studio</title>
+  <style>
+    g { fill: #171717; }
+    @media (prefers-color-scheme: dark) { g { fill: #f2f2ef; } }
+  </style>
+  <metadata>Source Serif 4 v4.005, weight 400, optical size 60, tracking -0.01em, word gap 0.18em. Converted to outlines.</metadata>
+  <g fill="#171717" transform="translate(90 1116) scale(1 -1)">
+    <path d="M343 -16Q278 -16 224.0 8.5Q170 33 130.0 79.0Q90 125 68.5 190.0Q47 255 47 336Q47 416 69.5 480.5Q92 545 132.5 591.0Q173 637 227.0 661.5Q281 686 344 686Q379 686 423.0 677.5Q467 669 510 639L520 484H504L445 651L491 642L495 616Q455 646 419.5 655.5Q384 665 348 665Q288 665 237.5 626.5Q187 588 157.0 514.0Q127 440 127 334Q127 228 155.5 154.5Q184 81 233.0 43.0Q282 5 345 5Q378 5 418.5 14.0Q459 23 499 55V28L453 20L511 188H528L518 32Q475 4 431.5 -6.0Q388 -16 343 -16Z" transform="translate(0 0)"/>
+    <path d="M35 0V16L131 28H150L245 16V0ZM105 0Q107 23 107.5 61.0Q108 99 108.5 139.5Q109 180 109 212V677L31 694V708L172 744L180 736L176 563V212Q176 180 176.5 139.5Q177 99 178.0 61.0Q179 23 180 0Z" transform="translate(562 0)"/>
+    <path d="M156 -12Q107 -12 73.0 16.5Q39 45 39 100Q39 128 50.0 153.0Q61 178 92.0 200.5Q123 223 184 243Q199 248 219.0 254.0Q239 260 266.5 267.5Q294 275 329 283V267Q278 252 247.5 242.0Q217 232 203 226Q161 208 141.5 189.0Q122 170 116.0 152.0Q110 134 110 117Q110 74 131.5 55.5Q153 37 185 37Q207 37 226.0 42.0Q245 47 267.0 61.5Q289 76 319 106L327 68H297Q276 40 253.5 22.0Q231 4 206.5 -4.0Q182 -12 156 -12ZM369 -8Q331 -8 311.5 13.5Q292 35 291 75V77V308Q291 357 281.5 385.5Q272 414 252.0 426.0Q232 438 200 438Q181 438 163.0 433.5Q145 429 125 422L153 441L134 361Q130 341 119.0 330.0Q108 319 91 319Q74 319 66.0 329.0Q58 339 56 356Q67 405 114.0 434.5Q161 464 225 464Q271 464 300.5 447.5Q330 431 344.5 396.0Q359 361 359 306V83Q359 52 367.5 40.5Q376 29 390 29Q403 29 412.0 35.0Q421 41 434 55L444 47Q434 23 416.0 7.5Q398 -8 369 -8Z" transform="translate(825 0)"/>
+    <path d="M57 -259Q42 -259 27.0 -254.5Q12 -250 1.0 -241.0Q-10 -232 -15 -218Q-13 -201 0.5 -191.5Q14 -182 33 -182Q50 -182 63.5 -188.5Q77 -195 91 -206L115 -224L106 -228L85 -234Q112 -219 132.0 -192.5Q152 -166 170.0 -127.5Q188 -89 207 -40L236 35L237 39L313 246L389 452H417L232 -40Q208 -105 182.5 -154.5Q157 -204 127.0 -231.5Q97 -259 57 -259ZM225 -6 44 452H123L266 70L241 25ZM4 436V452H211V437L111 424H91ZM309 437V452H461V436L397 428H385Z" transform="translate(1245 0)"/>
+    <path d="M216 -16Q163 -16 117.5 -1.0Q72 14 40 36L48 188H64L105 12L61 36V52Q90 35 113.0 24.5Q136 14 160.5 9.5Q185 5 216 5Q260 5 294.0 20.0Q328 35 347.5 68.0Q367 101 367 155Q367 194 350.0 220.5Q333 247 304.5 266.0Q276 285 243 300L207 317Q169 336 133.0 359.5Q97 383 74.5 418.5Q52 454 52 508Q52 566 78.5 605.5Q105 645 150.0 665.5Q195 686 249 686Q299 686 336.0 673.5Q373 661 401 638L397 494H381L337 659L384 639L388 613Q354 648 320.5 656.5Q287 665 249 665Q212 665 180.5 652.0Q149 639 129.5 608.5Q110 578 110 527Q110 489 127.0 462.5Q144 436 172.5 417.0Q201 398 234 382L269 365Q309 346 345.5 322.5Q382 299 405.5 263.5Q429 228 429 172Q429 114 404.0 71.5Q379 29 331.5 6.5Q284 -16 216 -16Z" transform="translate(1890 0)"/>
+    <path d="M121 428V452H276V428ZM185 -12Q138 -12 110.0 13.5Q82 39 82 89Q82 117 82.0 140.5Q82 164 82 198L84 428H8V444L119 462L83 440L133 604H155L151 440V436V97Q151 58 166.0 41.5Q181 25 207 25Q227 25 244.0 33.5Q261 42 275 58L286 49Q276 30 262.5 16.5Q249 3 230.5 -4.5Q212 -12 185 -12Z" transform="translate(2339 0)"/>
+    <path d="M213 -12Q156 -12 124.5 21.5Q93 55 93 129V429L114 399L24 418V432L156 464L164 456L160 330V147Q160 82 179.5 59.5Q199 37 242 37Q266 37 289.0 45.5Q312 54 336.0 71.0Q360 88 385 111L393 95H389Q370 70 342.5 45.0Q315 20 282.5 4.0Q250 -12 213 -12ZM379 -10V90V93V403L306 418V432L442 464L450 456L446 330V25L513 16V0Z" transform="translate(2627 0)"/>
+    <path d="M225 -12Q176 -12 135.0 13.5Q94 39 69.0 89.5Q44 140 44 216Q44 295 70.5 350.5Q97 406 141.0 435.0Q185 464 237 464Q264 464 289.5 455.0Q315 446 337.5 426.0Q360 406 378 372H392L385 347Q348 391 318.5 408.5Q289 426 248 426Q212 426 181.5 403.5Q151 381 133.0 335.0Q115 289 115 220Q115 153 132.0 110.0Q149 67 179.5 46.0Q210 25 248 25Q289 25 321.0 51.0Q353 77 381 118L387 89H374Q359 61 337.0 38.0Q315 15 287.0 1.5Q259 -12 225 -12ZM365 -10V85V88V376V384V677L290 694V708L428 744L436 736L432 540V25L501 16V0Z" transform="translate(3153 0)"/>
+    <path d="M35 0V16L131 28H150L245 16V0ZM105 0Q107 23 107.5 61.0Q108 99 108.5 139.5Q109 180 109 212V258Q109 300 108.5 329.0Q108 358 106 389L31 406V420L172 464L180 456L176 330V212Q176 180 176.5 139.5Q177 99 178.0 61.0Q179 23 180 0ZM140 569Q118 569 102.5 583.0Q87 597 87 622Q87 646 102.5 660.0Q118 674 140 674Q163 674 178.0 660.0Q193 646 193 622Q193 597 178.0 583.0Q163 569 140 569Z" transform="translate(3672 0)"/>
+    <path d="M251 -12Q196 -12 149.0 14.5Q102 41 73.0 93.5Q44 146 44 224Q44 302 73.0 355.5Q102 409 149.0 436.5Q196 464 251 464Q306 464 353.0 437.5Q400 411 429.0 359.0Q458 307 458 228Q458 151 429.0 97.0Q400 43 353.0 15.5Q306 -12 251 -12ZM251 9Q292 9 322.0 34.5Q352 60 368.0 109.0Q384 158 384 228Q384 298 368.0 345.5Q352 393 322.0 418.0Q292 443 251 443Q210 443 179.5 417.5Q149 392 133.0 343.0Q117 294 117 224Q117 155 133.0 107.0Q149 59 179.5 34.0Q210 9 251 9Z" transform="translate(3930 0)"/>
+  </g>
+</svg>