clay-server 4.0.0-beta.6 → 4.0.0-beta.7

package/lib/project-vendor-login.js

@@ -20,6 +20,7 @@
 // auth_required forever.
 
 var vendorRegistry = require("./yoke/vendor-registry");
+var yoke = require("./yoke");
 
 // Login CLIs print a success line and then hand the shell back, so the PTY
 // itself does not exit. Watch the output stream instead. Deliberately narrow:
@@ -209,6 +210,10 @@ function attachVendorLogin(ctx) {
     flow.finishing = true;
     flow.completed = !!succeeded;
 
+    // The next session must not reuse the pre-login "not authenticated"
+    // result. Re-check before restarting the runtime, which will then read
+    // the newly written credential file.
+    if (succeeded) yoke.invalidateAuthCache();
     var refresh = succeeded ? refreshVendorAuth(vendor) : Promise.resolve(false);
     refresh.then(function (restarted) {
       discardFlow(vendor);

package/lib/sdk-message-processor.js

@@ -61,6 +61,20 @@ function attachMessageProcessor(ctx) {
     if (session._lastAuthEmit && (now - session._lastAuthEmit) < 5000) return;
     session._lastAuthEmit = now;
 
+    // Codex can leave a transient 401 in its app-server event stream after a
+    // successful device login. Confirm the CLI's current credential state
+    // before interrupting another session with a login modal.
+    var vendor = session.vendor || "claude";
+    yoke.invalidateAuthCache();
+    var authState = yoke.checkAuth();
+    if (authState[vendor]) {
+      sendAndRecord(session, {
+        type: "error",
+        text: "Authentication is available, but " + vendor + " reported an auth-like error. Try again.",
+      });
+      return;
+    }
+
     var authUser = session.ownerId ? usersModule.findUserById(session.ownerId) : null;
     var authLinuxUser = authUser && authUser.linuxUser ? authUser.linuxUser : null;
     var canAutoLogin = !usersModule.isMultiUser()
@@ -76,7 +90,7 @@ function attachMessageProcessor(ctx) {
     sendToSession(session, {
       type: "auth_required",
       text: authTitle,
-      vendor: session.vendor || "claude",
+      vendor: vendor,
       loginCommand: loginCommand,
       linuxUser: authLinuxUser,
       canAutoLogin: canAutoLogin,
@@ -88,7 +102,7 @@ function attachMessageProcessor(ctx) {
         slug: slug,
         sessionId: session.localId,
         ownerId: session.ownerId || null,
-        vendor: session.vendor || "claude",
+        vendor: vendor,
         loginCommand: loginCommand,
         linuxUser: authLinuxUser,
         canAutoLogin: canAutoLogin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.6",
+  "version": "4.0.0-beta.7",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",