clay-server 4.0.0-beta.5 → 4.0.0-beta.7

package/lib/project-vendor-login.js

@@ -20,6 +20,7 @@
 // auth_required forever.
 
 var vendorRegistry = require("./yoke/vendor-registry");
+var yoke = require("./yoke");
 
 // Login CLIs print a success line and then hand the shell back, so the PTY
 // itself does not exit. Watch the output stream instead. Deliberately narrow:
@@ -209,6 +210,10 @@ function attachVendorLogin(ctx) {
     flow.finishing = true;
     flow.completed = !!succeeded;
 
+    // The next session must not reuse the pre-login "not authenticated"
+    // result. Re-check before restarting the runtime, which will then read
+    // the newly written credential file.
+    if (succeeded) yoke.invalidateAuthCache();
     var refresh = succeeded ? refreshVendorAuth(vendor) : Promise.resolve(false);
     refresh.then(function (restarted) {
       discardFlow(vendor);

package/lib/public/modules/app-messages.js

@@ -1300,10 +1300,10 @@ export function processMessage(msg) {
         appendDelta((msg.text || "Authentication required.") + "\n");
         setStatus("connected");
         if (!store.get('loopActive')) enableMainInput();
-        // Open the login flow for this vendor. The server keeps exactly one
-        // login terminal per vendor, so repeat auth_required events (other
-        // sessions, split panes, a 401 retry burst) do not stack up.
-        autoStartLoginIfNeeded(msg);
+        // Open the login flow only for a live auth failure. Older Clay
+        // versions recorded this transient event in session history; replaying
+        // one must not reopen a login terminal after the user signed in.
+        if (!store.get('replayingHistory')) autoStartLoginIfNeeded(msg);
         break;
 
       case "vendor_login_ready":

package/lib/sdk-message-processor.js

@@ -61,6 +61,20 @@ function attachMessageProcessor(ctx) {
     if (session._lastAuthEmit && (now - session._lastAuthEmit) < 5000) return;
     session._lastAuthEmit = now;
 
+    // Codex can leave a transient 401 in its app-server event stream after a
+    // successful device login. Confirm the CLI's current credential state
+    // before interrupting another session with a login modal.
+    var vendor = session.vendor || "claude";
+    yoke.invalidateAuthCache();
+    var authState = yoke.checkAuth();
+    if (authState[vendor]) {
+      sendAndRecord(session, {
+        type: "error",
+        text: "Authentication is available, but " + vendor + " reported an auth-like error. Try again.",
+      });
+      return;
+    }
+
     var authUser = session.ownerId ? usersModule.findUserById(session.ownerId) : null;
     var authLinuxUser = authUser && authUser.linuxUser ? authUser.linuxUser : null;
     var canAutoLogin = !usersModule.isMultiUser()
@@ -70,10 +84,13 @@ function attachMessageProcessor(ctx) {
     var authTitle = ((vendorInfo && vendorInfo.displayName) || "Claude Code") + " is not logged in.";
     var loginCommand = (vendorInfo && vendorInfo.loginCommand) || "claude login";
     var _nmLogin = getNotificationsModule();
-    sendAndRecord(session, {
+    // Authentication recovery is transient UI state, not transcript content.
+    // Recording it makes history replay look like a fresh auth failure and
+    // re-opens the login terminal after a successful sign-in.
+    sendToSession(session, {
       type: "auth_required",
       text: authTitle,
-      vendor: session.vendor || "claude",
+      vendor: vendor,
       loginCommand: loginCommand,
       linuxUser: authLinuxUser,
       canAutoLogin: canAutoLogin,
@@ -85,7 +102,7 @@ function attachMessageProcessor(ctx) {
         slug: slug,
         sessionId: session.localId,
         ownerId: session.ownerId || null,
-        vendor: session.vendor || "claude",
+        vendor: vendor,
         loginCommand: loginCommand,
         linuxUser: authLinuxUser,
         canAutoLogin: canAutoLogin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.5",
+  "version": "4.0.0-beta.7",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",