clay-server 4.0.0-beta.18 → 4.0.0-beta.19

package/lib/daemon-projects.js

@@ -29,9 +29,9 @@ function isWorktreeSlug(slug) {
  * @param {string} parentIcon - icon of parent project
  * @param {string} parentOwnerId - owner user ID
  */
-function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, projectKnowledgeId) {
-  if (isWorktree(parentPath)) return;
-  var worktrees = scanWorktrees(parentPath);
+function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, projectKnowledgeId, osUserInfo) {
+  if (isWorktree(parentPath, osUserInfo)) return;
+  var worktrees = scanWorktrees(parentPath, osUserInfo);
   if (worktrees.length === 0) return;
   if (!worktreeRegistry[parentSlug]) worktreeRegistry[parentSlug] = [];
   for (var i = 0; i < worktrees.length; i++) {
@@ -42,14 +42,14 @@ function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, par
       if (worktreeRegistry[parentSlug][j] === wtSlug) { alreadyRegistered = true; break; }
     }
     if (alreadyRegistered) continue;
-    var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName });
+    var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName }, osUserInfo);
     var wtMeta = Object.assign({ parentSlug: parentSlug, external: wt.external, projectKnowledgeId: projectKnowledgeId }, context);
     relay.addProject(wt.path, wtSlug, wt.branch || wt.dirName, parentIcon, parentOwnerId, wtMeta);
     worktreeRegistry[parentSlug].push(wtSlug);
     console.log("[daemon] Registered worktree:", wtSlug, "->", wt.path, wt.external ? "(external)" : "(inside project folder)");
   }
   daemonSync.register(getWorktreeSyncKey(parentSlug), function () {
-    rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, null, projectKnowledgeId);
+    rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, null, projectKnowledgeId, osUserInfo);
   });
 }
 
@@ -62,11 +62,11 @@ function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, par
  * @param {string} parentOwnerId - owner user ID
  * @param {object} [config] - daemon config (optional, for broadcasting project count)
  */
-function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, config, projectKnowledgeId) {
+function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, config, projectKnowledgeId, osUserInfo) {
   if (worktreeScanning[parentSlug]) return;
   worktreeScanning[parentSlug] = true;
   try {
-    var discovered = scanWorktrees(parentPath);
+    var discovered = scanWorktrees(parentPath, osUserInfo);
     var changed = false;
     var existingSlugs = worktreeRegistry[parentSlug] || [];
     var discoveredNames = {};
@@ -81,7 +81,7 @@ function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerI
         if (existingSlugs[ei] === wtSlug) { found = true; break; }
       }
       if (!found) {
-        var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName });
+        var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName }, osUserInfo);
         var wtMeta = Object.assign({ parentSlug: parentSlug, external: wt.external, projectKnowledgeId: projectKnowledgeId }, context);
         relay.addProject(wt.path, wtSlug, wt.branch || wt.dirName, parentIcon, parentOwnerId, wtMeta);
         if (!worktreeRegistry[parentSlug]) worktreeRegistry[parentSlug] = [];

package/lib/daemon.js

@@ -173,6 +173,25 @@ function projectRuntimeOptions(project) {
   return { projectKnowledgeId: project.projectKnowledgeId };
 }
 
+function worktreeOsUserInfo(project, requestUser) {
+  if (!config.osUsers) return null;
+  var owner = project && project.ownerId ? usersModule.findUserById(project.ownerId) : null;
+  var executionUser = owner && owner.linuxUser ? owner : requestUser;
+  if (!executionUser || !executionUser.linuxUser) {
+    throw new Error("The project owner does not have a provisioned Linux account");
+  }
+  return osUsersMod.resolveOsUserInfo(executionUser.linuxUser);
+}
+
+function registerProjectWorktrees(project, requestUser) {
+  try {
+    var osUserInfo = worktreeOsUserInfo(project, requestUser);
+    scanAndRegisterWorktrees(relay, project.path, project.slug, project.icon, project.ownerId, project.projectKnowledgeId, osUserInfo);
+  } catch (e) {
+    console.error("[daemon] Failed to scan worktrees for " + project.slug + ": " + e.message);
+  }
+}
+
 var relay = createServer({
   tlsOptions: tlsOptions,
   caPath: caRoot,
@@ -219,7 +238,7 @@ var relay = createServer({
       }
     }
     // Discover and register worktrees for the new project
-    scanAndRegisterWorktrees(relay, absPath, slug, null, wsUser && wsUser.id && wsUser.role !== "admin" ? wsUser.id : null, projectEntry.projectKnowledgeId);
+    registerProjectWorktrees(projectEntry, wsUser);
     // Broadcast updated project list to all clients
     relay.broadcastAll({
       type: "projects_updated",
@@ -404,8 +423,15 @@ var relay = createServer({
       }
       if (parentProject) {
         var wtPath = path.join(parentProject.path, wtDirName);
-        var contextStatus = projectLogContext.isMerged(parentProject.path, wtPath) ? "merged" : "archived";
-        var rmResult = removeWorktree(parentProject.path, wtDirName);
+        var removeUser = userId ? usersModule.findUserById(userId) : null;
+        var removeOsUserInfo;
+        try {
+          removeOsUserInfo = worktreeOsUserInfo(parentProject, removeUser);
+        } catch (e) {
+          return { ok: false, error: e.message };
+        }
+        var contextStatus = projectLogContext.isMerged(parentProject.path, wtPath, removeOsUserInfo) ? "merged" : "archived";
+        var rmResult = removeWorktree(parentProject.path, wtDirName, removeOsUserInfo);
         if (!rmResult.ok) {
           console.log("[daemon] Failed to remove worktree:", slug, rmResult.error);
           return { ok: false, error: rmResult.error };
@@ -1003,23 +1029,29 @@ var relay = createServer({
     if (!config.osUsers || !linuxUser) return;
     deactivateLinuxUser(linuxUser);
   },
-  onCreateWorktree: function (parentSlug, branchName, dirName, baseBranch) {
+  onCreateWorktree: function (parentSlug, branchName, dirName, baseBranch, requestUser) {
     // Find the parent project
     var parent = null;
     for (var j = 0; j < config.projects.length; j++) {
       if (config.projects[j].slug === parentSlug) { parent = config.projects[j]; break; }
     }
     if (!parent) return { ok: false, error: "Parent project not found" };
-    if (isWorktree(parent.path)) return { ok: false, error: "Cannot create worktrees from a worktree project" };
-    var baseCommit = projectLogContext.commit(parent.path, baseBranch || "HEAD");
-    var result = createWorktree(parent.path, branchName, dirName, baseBranch);
+    var osUserInfo;
+    try {
+      osUserInfo = worktreeOsUserInfo(parent, requestUser);
+    } catch (e) {
+      return { ok: false, error: e.message };
+    }
+    if (isWorktree(parent.path, osUserInfo)) return { ok: false, error: "Cannot create worktrees from a worktree project" };
+    var baseCommit = projectLogContext.commit(parent.path, baseBranch || "HEAD", osUserInfo);
+    var result = createWorktree(parent.path, branchName, dirName, baseBranch, osUserInfo);
     if (!result.ok) return result;
     // Register the new worktree as ephemeral project
     var wtSlug = parentSlug + "--" + dirName;
     var context = projectLogContext.resolveWorktreeContext(result.path, parent.projectKnowledgeId, {
       branch: branchName,
       baseCommit: baseCommit,
-    });
+    }, osUserInfo);
     var wtMeta = Object.assign({ parentSlug: parentSlug, external: false, projectKnowledgeId: parent.projectKnowledgeId }, context);
     relay.addProject(result.path, wtSlug, branchName, parent.icon, parent.ownerId, wtMeta);
     registerWorktreeSlug(parentSlug, wtSlug);
@@ -1114,7 +1146,7 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       try { syncClayrc(config.projects); } catch (e) {}
       console.log("[daemon] Added project:", slug, "→", absPath);
       // Discover and register worktrees for the new project
-      scanAndRegisterWorktrees(relay, absPath, slug, null, null, projectEntry.projectKnowledgeId);
+      registerProjectWorktrees(projectEntry, null);
       relay.broadcastAll({
         type: "projects_updated",
         projects: relay.getProjects(),
@@ -1345,7 +1377,7 @@ for (var i = 0; i < projects.length; i++) {
     console.log("[daemon] Adding project:", p.slug, "→", p.path);
     relay.addProject(p.path, p.slug, p.title, p.icon, p.ownerId, null, projectRuntimeOptions(p));
     // Discover and register worktrees for this project
-    scanAndRegisterWorktrees(relay, p.path, p.slug, p.icon, p.ownerId, p.projectKnowledgeId);
+    registerProjectWorktrees(p, null);
   } else {
     console.log("[daemon] Skipping missing project:", p.path);
   }

package/lib/git-cli.js

@@ -458,6 +458,7 @@ module.exports = {
   parsePorcelainV2: parsePorcelainV2,
   parseWorktrees: parseWorktrees,
   readWorkingTreeFile: readWorkingTreeFile,
+  runGitSync: runGitSync,
   runAction: runAction,
   shortRemoteLabel: shortRemoteLabel,
 };

package/lib/os-users.js

@@ -161,7 +161,9 @@ function fsAsUser(op, args, osUserInfo) {
       "var fs = require('fs');",
       "var f = " + JSON.stringify(args.file) + ";",
       "var content = " + JSON.stringify(args.content || "") + ";",
-      "fs.writeFileSync(f, content, 'utf8');",
+      "var flag = " + JSON.stringify(args.flag === "wx" ? "wx" : "w") + ";",
+      "var mode = " + JSON.stringify(typeof args.mode === "number" ? args.mode : 0o666) + ";",
+      "fs.writeFileSync(f, content, { encoding: 'utf8', flag: flag, mode: mode });",
       "process.stdout.write(JSON.stringify({ ok: true }));",
     ].join(" ");
   } else if (op === "mkdir") {

package/lib/project-log-context.js

@@ -9,7 +9,8 @@
 var crypto = require("crypto");
 var fs = require("fs");
 var path = require("path");
-var execFileSync = require("child_process").execFileSync;
+var { runGitSync } = require("./git-cli");
+var { fsAsUser } = require("./os-users");
 var logsRoot = require("./project-logs-root");
 var utils = require("./utils");
 
@@ -47,23 +48,18 @@ function createProjectKnowledgeId() {
   return newId("pk");
 }
 
-function git(cwd, args) {
-  return execFileSync("git", args, {
-    cwd: cwd,
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["pipe", "pipe", "pipe"],
-  }).trim();
+function git(cwd, args, osUserInfo) {
+  return runGitSync(cwd, args, null, osUserInfo).trim();
 }
 
-function commit(cwd, ref) {
-  try { return git(cwd, ["rev-parse", ref || "HEAD"]); }
+function commit(cwd, ref, osUserInfo) {
+  try { return git(cwd, ["rev-parse", ref || "HEAD"], osUserInfo); }
   catch (e) { return null; }
 }
 
-function markerPath(cwd) {
+function markerPath(cwd, osUserInfo) {
   try {
-    var gitDir = git(cwd, ["rev-parse", "--git-dir"]);
+    var gitDir = git(cwd, ["rev-parse", "--git-dir"], osUserInfo);
     return path.join(path.resolve(cwd, gitDir), "clay-change-set.json");
   } catch (e) {
     return null;
@@ -86,9 +82,18 @@ function deterministicFallback(knowledgeId, cwd) {
   return "cs_" + digest.substring(0, 22);
 }
 
-function resolveWorktreeContext(cwd, knowledgeId, details) {
+function writeMarker(filePath, marker, osUserInfo) {
+  var content = JSON.stringify(marker, null, 2) + "\n";
+  if (osUserInfo) {
+    fsAsUser("write", { file: filePath, content: content, flag: "wx", mode: 0o600 }, osUserInfo);
+    return;
+  }
+  fs.writeFileSync(filePath, content, { flag: "wx", mode: 0o600 });
+}
+
+function resolveWorktreeContext(cwd, knowledgeId, details, osUserInfo) {
   var input = details || {};
-  var filePath = markerPath(cwd);
+  var filePath = markerPath(cwd, osUserInfo);
   var marker = readMarker(filePath, knowledgeId);
   if (!marker) {
     marker = {
@@ -99,7 +104,7 @@ function resolveWorktreeContext(cwd, knowledgeId, details) {
     };
     if (filePath) {
       try {
-        fs.writeFileSync(filePath, JSON.stringify(marker, null, 2) + "\n", { flag: "wx", mode: 0o600 });
+        writeMarker(filePath, marker, osUserInfo);
       } catch (e) {
         marker = readMarker(filePath, knowledgeId) || marker;
       }
@@ -113,20 +118,16 @@ function resolveWorktreeContext(cwd, knowledgeId, details) {
     changeSetId: marker.changeSetId,
     branch: input.branch || null,
     baseCommit: marker.baseCommit || input.baseCommit || null,
-    headCommit: commit(cwd, "HEAD"),
+    headCommit: commit(cwd, "HEAD", osUserInfo),
     status: "active",
   };
 }
 
-function isMerged(parentCwd, worktreeCwd) {
-  var head = commit(worktreeCwd, "HEAD");
+function isMerged(parentCwd, worktreeCwd, osUserInfo) {
+  var head = commit(worktreeCwd, "HEAD", osUserInfo);
   if (!head) return false;
   try {
-    execFileSync("git", ["merge-base", "--is-ancestor", head, "HEAD"], {
-      cwd: parentCwd,
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(parentCwd, ["merge-base", "--is-ancestor", head, "HEAD"], null, osUserInfo);
     return true;
   } catch (e) {
     return false;

package/lib/project-sessions.js

@@ -1777,8 +1777,12 @@ function attachSessions(ctx) {
         sendTo(ws, { type: "create_worktree_result", ok: false, error: "Invalid branch name" });
         return true;
       }
+      if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(wtDirName)) {
+        sendTo(ws, { type: "create_worktree_result", ok: false, error: "Invalid worktree directory name" });
+        return true;
+      }
       if (typeof onCreateWorktree === "function") {
-        var wtResult = onCreateWorktree(slug, wtBranch, wtDirName, wtBase);
+        var wtResult = onCreateWorktree(slug, wtBranch, wtDirName, wtBase, ws._clayUser);
         sendTo(ws, { type: "create_worktree_result", ok: wtResult.ok, slug: wtResult.slug, error: wtResult.error });
       } else {
         sendTo(ws, { type: "create_worktree_result", ok: false, error: "Not supported" });

package/lib/public/css/sidebar.css

@@ -930,6 +930,17 @@
   position: relative;
 }
 
+.session-driver-header {
+  display: flex;
+  align-items: center;
+}
+
+.session-driver-header > .session-item {
+  min-width: 0;
+  flex: 1;
+  padding-left: 0;
+}
+
 .session-driver-toggle {
   width: 18px;
   height: 24px;

package/lib/public/modules/app-home-hub.js

@@ -2,7 +2,7 @@
 
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
-import { getCachedProjects } from './app-projects.js';
+import { getCachedProjects, switchProject } from './app-projects.js';
 import { mateAvatarUrl } from './avatar.js';
 import { exitDmMode } from './app-dm.js';
 import { closeHomeDock, initHomeDock, renderDock, requestHomeDockPreference } from './home-dock.js';
@@ -41,7 +41,22 @@ function syncHomePresentation() {
 function syncHomeCloseControl() {
   var close = document.getElementById("home-close-control");
   if (!close) return;
-  close.classList.toggle("hidden", !store.get('currentSlug'));
+  close.classList.toggle("hidden", !getHomeReturnSlug());
+}
+
+function getHomeReturnSlug() {
+  var projects = getCachedProjects() || [];
+  var candidates = [store.get('currentSlug'), store.get('homeSurfaceProjectSlug')];
+  for (var ci = 0; ci < candidates.length; ci++) {
+    if (!candidates[ci]) continue;
+    for (var pi = 0; pi < projects.length; pi++) {
+      if (projects[pi] && !projects[pi].isMate && projects[pi].slug === candidates[ci]) return candidates[ci];
+    }
+  }
+  for (var i = 0; i < projects.length; i++) {
+    if (projects[i] && !projects[i].isMate && projects[i].slug) return projects[i].slug;
+  }
+  return null;
 }
 
 function getVisibleMates() {
@@ -390,13 +405,10 @@ export function hideHomeHub() {
 }
 
 export function minimizeHomeHub() {
-  var slug = store.get('currentSlug');
+  var slug = getHomeReturnSlug();
   if (!slug || !homeHubVisible) return;
   rememberHomePrimarySurface("project");
-  hideHomeHub();
-  var route = "/p/" + slug + "/";
-  if (document.documentElement.classList.contains("pwa-standalone")) history.replaceState(null, "", route);
-  else history.pushState(null, "", route);
+  switchProject(slug);
   var projectInput = document.getElementById("input");
   if (projectInput && !projectInput.disabled) projectInput.focus({ preventScroll: true });
 }

package/lib/public/modules/app-projects.js

@@ -417,13 +417,15 @@ export function switchProject(slug) {
   if (!slug) return;
   document.cookie = "clay_last_project=" + encodeURIComponent(slug) + "; Path=/; SameSite=Strict; Max-Age=31536000";
   var st = store.snap();
+  var targetWsPath = "/p/" + slug + "/ws";
+  var alreadyInProject = slug === st.currentSlug && st.wsPath === targetWsPath;
   var wasDm = st.dmMode;
   var wasMate = st.dmMode && st.dmTargetUser && st.dmTargetUser.isMate;
   if (st.dmMode) exitDmMode(wasMate);
   closeWhatsNewArticle();
   if (isHomeHubVisible()) {
     hideHomeHub();
-    if (slug === store.get('currentSlug')) {
+    if (alreadyInProject) {
       if (document.documentElement.classList.contains("pwa-standalone")) {
         history.replaceState(null, "", "/p/" + slug + "/");
       } else {
@@ -432,7 +434,7 @@ export function switchProject(slug) {
       return;
     }
   }
-  if (slug === store.get('currentSlug')) {
+  if (alreadyInProject) {
     var ws = getWs();
     if (wasDm && ws && ws.readyState === 1) {
       ws.send(JSON.stringify({ type: "switch_session", id: store.get('activeSessionId') }));
@@ -446,7 +448,7 @@ export function switchProject(slug) {
   resetScheduler(slug);
   store.set({ currentSlug: slug });
   store.set({ basePath: "/p/" + slug + "/" });
-  store.set({ wsPath: "/p/" + slug + "/ws" });
+  store.set({ wsPath: targetWsPath });
   if (document.documentElement.classList.contains("pwa-standalone")) {
     history.replaceState(null, "", "/p/" + slug + "/");
   } else {

package/lib/public/modules/sidebar-session-hierarchy.js

@@ -55,10 +55,6 @@ export function hierarchyItemMatches(item, matchIds) {
   return true;
 }
 
-export function isDesktopHierarchyToggleEvent(event) {
-  return !!(event && event.target && typeof event.target.closest === "function" && event.target.closest(".session-driver-toggle"));
-}
-
 function expanded(surface, key, workers, matchIds) {
   var state = expansionBySurface[surface];
   if (state.has(key)) return state.get(key);
@@ -88,6 +84,8 @@ export function renderDesktopDriverHierarchy(root, renderSession, rerender, matc
   var key = "driver:" + root.driver.id;
   var isExpanded = expanded("desktop", key, root.workers, matchIds);
   var childrenId = "session-workers-" + root.driver.id;
+  var header = document.createElement("div");
+  header.className = "session-driver-header";
   var row = renderSession(root.driver);
   row.classList.add("session-driver-item");
   var control = document.createElement("button");
@@ -113,8 +111,9 @@ export function renderDesktopDriverHierarchy(root, renderSession, rerender, matc
     children.hidden = !nextExpanded;
     isExpanded = nextExpanded;
   });
-  row.insertBefore(control, row.firstChild);
-  wrapper.appendChild(row);
+  header.appendChild(control);
+  header.appendChild(row);
+  wrapper.appendChild(header);
 
   var current = currentWorkerIds();
   for (var i = 0; i < root.workers.length; i++) {

package/lib/public/modules/sidebar-sessions.js

@@ -18,7 +18,6 @@ import { groupedSessionIds } from './split-group-helpers.js';
 import { openPairDialog } from './split-pair-ui.js';
 import {
   hierarchyItemMatches,
-  isDesktopHierarchyToggleEvent,
   prepareSidebarHierarchy,
   renderDesktopDriverHierarchy,
   renderDesktopOrphanHierarchy
@@ -1334,8 +1333,7 @@ function renderSessionItem(s, options) {
   appendSessionCloseButton(el, s);
 
   el.addEventListener("click", (function (id) {
-    return function (event) {
-      if (isDesktopHierarchyToggleEvent(event)) return;
+    return function () {
       if (getWs() && store.get('connected')) {
         var pendingQuery = searchQuery || "";
         getWs().send(JSON.stringify({ type: "switch_session", id: id }));

package/lib/server-global-ws.js

@@ -7,7 +7,7 @@
 // Bound to the slug-less `/ws` endpoint by lib/server.js. Only handles the
 // small set of messages needed to bootstrap into a project context:
 //   - ping            -> pong keep-alive
-//   - home_*           -> user-scoped Home preferences
+//   - Home and Mate    -> the same user-scoped handlers as project sockets
 //   - browse_dir      -> directory picker for the add-project modal
 //   - add_project     -> register an existing directory
 //   - create_project  -> make a new empty project
@@ -39,6 +39,7 @@ function attachGlobalWs(opts) {
   var onCreateProject = opts.onCreateProject;
   var onCloneProject = opts.onCloneProject;
   var onHomePreferenceMessage = opts.onHomePreferenceMessage;
+  var onAppMessage = opts.onAppMessage;
 
   function handleMessage(ws, msg) {
     if (!msg || typeof msg !== "object") return;
@@ -48,6 +49,12 @@ function attachGlobalWs(opts) {
       return;
     }
 
+    // A user does not need an ordinary project before Home becomes useful.
+    // Route Mate discovery, Home chat/debates, and tools through the same
+    // handlers used by project sockets. This also lets mate_list repair an
+    // existing account whose built-ins were missing from its final storage.
+    if (typeof onAppMessage === "function" && onAppMessage(ws, msg)) return;
+
     if (typeof onHomePreferenceMessage === "function" && onHomePreferenceMessage(ws, msg)) return;
 
     // --- Directory picker for the add-project modal ---

package/lib/server.js

@@ -1011,6 +1011,9 @@ function createServer(opts) {
     onHomePreferenceMessage: function (ws, msg) {
       return homePreferencesHandler ? homePreferencesHandler.handleMessage(ws, msg) : false;
     },
+    onAppMessage: function (ws, msg) {
+      return handleDmMessage(ws, msg);
+    },
   });
 
   server.on("upgrade", function (req, socket, head) {
@@ -1484,13 +1487,14 @@ function createServer(opts) {
   }
 
   function handleDmMessage(ws, msg, routedProjectSlug) {
-    if (assignmentService.handleMessage(ws, msg, routedProjectSlug)) return;
-    if (dmHandler.handleMessage(ws, msg)) return;
-    if (mateHandler && mateHandler.handleMessage(ws, msg)) return;
-    if (emailHandler.handleMessage(ws, msg)) return;
-    if (homeChatHandler.handleMessage(ws, msg)) return;
-    if (homePreferencesHandler.handleMessage(ws, msg)) return;
-    if (toolsHandler.handleMessage(ws, msg)) return;
+    if (assignmentService.handleMessage(ws, msg, routedProjectSlug)) return true;
+    if (dmHandler.handleMessage(ws, msg)) return true;
+    if (mateHandler && mateHandler.handleMessage(ws, msg)) return true;
+    if (emailHandler.handleMessage(ws, msg)) return true;
+    if (homeChatHandler.handleMessage(ws, msg)) return true;
+    if (homePreferencesHandler.handleMessage(ws, msg)) return true;
+    if (toolsHandler.handleMessage(ws, msg)) return true;
+    return false;
   }
 
   function removeProject(slug) {

package/lib/session-hygiene.js

@@ -2,6 +2,8 @@
 // "New session" request and which abandoned blanks are safe to sweep.
 // Pure decision logic only -- deletion/switching stays in sessions.js.
 
+var sessionProvenance = require("./session-provenance");
+
 var BLANK_SESSION_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 var CLAUDE_INTERRUPTED_TEXT = "[Request interrupted by user]";
 
@@ -19,6 +21,7 @@ function isBlankSession(s) {
     && !s.bookmarked
     && !s.spawn
     && !s.loop
+    && !sessionProvenance.isWorker(s)
     && (s.mode || "gui") !== "tui"
     && s.terminalId == null;
 }

package/lib/users.js

@@ -55,6 +55,16 @@ function generateUserId() {
   return crypto.randomUUID();
 }
 
+function ensureUserBuiltinMates(userId) {
+  try {
+    var mates = require("./mates");
+    var mateCtx = mates.buildMateCtx(userId);
+    mates.ensureBuiltinMates(mateCtx);
+  } catch (e) {
+    console.error("[users] Failed to seed built-in mates for user " + userId + ":", e.message);
+  }
+}
+
 function createUser(opts) {
   var data = loadUsers();
   // Check username uniqueness
@@ -92,14 +102,9 @@ function createUser(opts) {
   data.users.push(user);
   saveUsers(data);
 
-  // Seed built-in mates for the new user
-  try {
-    var mates = require("./mates");
-    var mateCtx = mates.buildMateCtx(user.id);
-    mates.ensureBuiltinMates(mateCtx);
-  } catch (e) {
-    console.error("[users] Failed to seed built-in mates for user " + user.id + ":", e.message);
-  }
+  // Seed immediately for ordinary multi-user storage. OS-user provisioning
+  // calls this again after the Linux mapping exists, targeting its final home.
+  ensureUserBuiltinMates(user.id);
 
   return { ok: true, user: user };
 }
@@ -246,6 +251,7 @@ function updateLinuxUser(userId, linuxUsername) {
       if (data.users[i].id === userId) {
         data.users[i].linuxUser = null;
         saveUsers(data);
+        ensureUserBuiltinMates(userId);
         return { ok: true };
       }
     }
@@ -269,6 +275,7 @@ function updateLinuxUser(userId, linuxUsername) {
     if (data.users[i].id === userId) {
       data.users[i].linuxUser = linuxUsername;
       saveUsers(data);
+      ensureUserBuiltinMates(userId);
       return { ok: true };
     }
   }
@@ -326,14 +333,7 @@ function createUserWithoutPin(opts) {
   data.users.push(user);
   saveUsers(data);
 
-  // Seed built-in mates for the new user
-  try {
-    var mates = require("./mates");
-    var mateCtx = mates.buildMateCtx(user.id);
-    mates.ensureBuiltinMates(mateCtx);
-  } catch (e) {
-    console.error("[users] Failed to seed built-in mates for user " + user.id + ":", e.message);
-  }
+  ensureUserBuiltinMates(user.id);
 
   return { ok: true, user: user };
 }

package/lib/worktree.js

@@ -1,6 +1,6 @@
-var { execFileSync } = require("child_process");
 var fs = require("fs");
 var path = require("path");
+var { runGitSync } = require("./git-cli");
 
 // Parse `git worktree list --porcelain` output into structured objects
 function parseWorktreeOutput(output) {
@@ -28,14 +28,10 @@ function parseWorktreeOutput(output) {
 }
 
 // Check if a given path is itself a worktree (not the main working tree)
-function isWorktree(projectPath) {
+function isWorktree(projectPath, osUserInfo) {
   try {
-    var gitDir = execFileSync("git", ["rev-parse", "--git-dir"], {
-      cwd: projectPath, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
-    var commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
-      cwd: projectPath, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
+    var gitDir = runGitSync(projectPath, ["rev-parse", "--git-dir"], null, osUserInfo).trim();
+    var commonDir = runGitSync(projectPath, ["rev-parse", "--git-common-dir"], null, osUserInfo).trim();
     var absGit = path.resolve(projectPath, gitDir);
     var absCommon = path.resolve(projectPath, commonDir);
     return absGit !== absCommon;
@@ -49,18 +45,21 @@ function isPathInside(parentPath, candidatePath) {
   return relative !== "" && relative !== ".." && relative.indexOf(".." + path.sep) !== 0 && !path.isAbsolute(relative);
 }
 
+function worktreePath(projectPath, dirName) {
+  if (typeof dirName !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(dirName)) return null;
+  var resolvedParent = path.resolve(projectPath);
+  var resolvedWorktree = path.resolve(resolvedParent, dirName);
+  return isPathInside(resolvedParent, resolvedWorktree) ? resolvedWorktree : null;
+}
+
 // Scan worktrees for a given project path
 // Returns array of { path, branch, bare, detached, external }
 // external = true when Git registered the worktree outside the main project folder
-function scanWorktrees(projectPath) {
+function scanWorktrees(projectPath, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
+  try { resolvedParent = fs.realpathSync(resolvedParent); } catch (e) {}
   try {
-    var output = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    var output = runGitSync(resolvedParent, ["worktree", "list", "--porcelain"], null, osUserInfo);
     var all = parseWorktreeOutput(output);
     // Filter out bare worktrees and the main worktree itself
     var results = [];
@@ -68,10 +67,11 @@ function scanWorktrees(projectPath) {
       var wt = all[i];
       if (wt.bare) continue;
       var resolvedWt = path.resolve(wt.path);
-      if (resolvedWt === resolvedParent) continue;
       // Git retains removed worktrees until `git worktree prune` runs. Do not
       // register those stale paths as Clay projects.
       if (!fs.existsSync(resolvedWt)) continue;
+      try { resolvedWt = fs.realpathSync(resolvedWt); } catch (e) {}
+      if (resolvedWt === resolvedParent) continue;
       wt.external = !isPathInside(resolvedParent, resolvedWt);
       wt.dirName = path.basename(wt.path);
       results.push(wt);
@@ -84,28 +84,19 @@ function scanWorktrees(projectPath) {
 
 // Create a new worktree inside the parent project directory
 // Returns { ok, path, error }
-function createWorktree(projectPath, branchName, dirName, baseBranch) {
+function createWorktree(projectPath, branchName, dirName, baseBranch, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
-  var wtPath = path.join(resolvedParent, dirName || branchName);
+  var wtPath = worktreePath(resolvedParent, dirName || branchName);
+  if (!wtPath) return { ok: false, error: "Invalid worktree directory name" };
   var base = baseBranch || "main";
   // Try creating with -b (new branch)
   try {
-    execFileSync("git", ["worktree", "add", wtPath, "-b", branchName, base], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(resolvedParent, ["worktree", "add", wtPath, "-b", branchName, base], { timeout: 15000 }, osUserInfo);
     return { ok: true, path: wtPath };
   } catch (e) {
     // Branch may already exist, try without -b
     try {
-      execFileSync("git", ["worktree", "add", wtPath, branchName], {
-        cwd: resolvedParent,
-        encoding: "utf8",
-        timeout: 15000,
-        stdio: ["pipe", "pipe", "pipe"],
-      });
+      runGitSync(resolvedParent, ["worktree", "add", wtPath, branchName], { timeout: 15000 }, osUserInfo);
       return { ok: true, path: wtPath };
     } catch (e2) {
       return { ok: false, error: e2.message || "Failed to create worktree" };
@@ -115,17 +106,13 @@ function createWorktree(projectPath, branchName, dirName, baseBranch) {
 
 // Remove a worktree
 // Returns { ok, error }
-function removeWorktree(projectPath, worktreeDirName) {
+function removeWorktree(projectPath, worktreeDirName, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
-  var wtPath = path.join(resolvedParent, worktreeDirName);
+  var wtPath = worktreePath(resolvedParent, worktreeDirName);
+  if (!wtPath) return { ok: false, error: "Invalid worktree directory name" };
   // Try normal remove first
   try {
-    execFileSync("git", ["worktree", "remove", wtPath], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(resolvedParent, ["worktree", "remove", wtPath], { timeout: 15000 }, osUserInfo);
     return { ok: true };
   } catch (e) {
     var errMsg = (e.stderr || e.message || "").toString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.18",
+  "version": "4.0.0-beta.19",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",