clay-server 4.0.0-beta.6 → 4.0.0-beta.8

package/lib/project-vendor-login.js

@@ -20,6 +20,7 @@
 // auth_required forever.
 
 var vendorRegistry = require("./yoke/vendor-registry");
+var yoke = require("./yoke");
 
 // Login CLIs print a success line and then hand the shell back, so the PTY
 // itself does not exit. Watch the output stream instead. Deliberately narrow:
@@ -62,7 +63,8 @@ function looksLikeLoginSuccess(text) {
  *   sm, tm, adapters,
  *   send, sendTo,
  *   usersModule,
- *   getOsUserInfoForWs, getOsUserInfoForLinuxUser, getLinuxUserForSession
+ *   getOsUserInfoForWs, getOsUserInfoForLinuxUser, getLinuxUserForSession,
+ *   refreshVendorAuthEverywhere
  */
 function attachVendorLogin(ctx) {
   var slug = ctx.slug;
@@ -80,6 +82,7 @@ function attachVendorLogin(ctx) {
   var getOsUserInfoForWs = ctx.getOsUserInfoForWs;
   var getOsUserInfoForLinuxUser = ctx.getOsUserInfoForLinuxUser;
   var getLinuxUserForSession = ctx.getLinuxUserForSession;
+  var refreshVendorAuthEverywhere = ctx.refreshVendorAuthEverywhere;
 
   // vendor -> flow record. At most one live login terminal per vendor.
   var _flows = Object.create(null);
@@ -181,13 +184,17 @@ function attachVendorLogin(ctx) {
   // the credentials the login just wrote. Shared adapter instances (Claude) are
   // reused by every project, so tearing one down here would kill unrelated
   // sessions; those runtimes pick up new credentials on their own.
-  function refreshVendorAuth(vendor) {
+  function refreshVendorAuth(vendor, linuxUser) {
     var adapter = adapters[vendor];
     if (!adapter || typeof adapter.shutdown !== "function") return Promise.resolve(false);
     if (adapter.shared) {
       console.log("[vendor-login] " + vendor + " adapter is shared; skipping restart for " + slug);
       return Promise.resolve(false);
     }
+    if (typeof adapter.refreshAuthIdentity === "function") {
+      return Promise.resolve(adapter.refreshAuthIdentity(linuxUser || null));
+    }
+    if (linuxUser) return Promise.resolve(false);
     // adapter.shutdown() already fans out to every per-OS-user runtime it
     // created (shutdownUserRuntimes), so one call covers isolated setups too.
     return Promise.resolve()
@@ -209,7 +216,16 @@ function attachVendorLogin(ctx) {
     flow.finishing = true;
     flow.completed = !!succeeded;
 
-    var refresh = succeeded ? refreshVendorAuth(vendor) : Promise.resolve(false);
+    // The next session must not reuse the pre-login "not authenticated"
+    // result. Re-check before restarting the runtime, which will then read
+    // the newly written credential file.
+    if (succeeded) yoke.invalidateAuthCache();
+    var refresh = Promise.resolve(false);
+    if (succeeded) {
+      refresh = typeof refreshVendorAuthEverywhere === "function"
+        ? refreshVendorAuthEverywhere(vendor, flow.linuxUser || null)
+        : refreshVendorAuth(vendor, flow.linuxUser || null);
+    }
     refresh.then(function (restarted) {
       discardFlow(vendor);
       closeFlowTerminal(flow);
@@ -391,6 +407,7 @@ function attachVendorLogin(ctx) {
     listFlows: listFlows,
     forgetTerminal: forgetTerminal,
     isLoginTerminal: isLoginTerminal,
+    refreshVendorAuth: refreshVendorAuth,
   };
 }
 

package/lib/project.js

@@ -1610,6 +1610,7 @@ function createProjectContext(opts) {
     getOsUserInfoForWs: getOsUserInfoForWs,
     getOsUserInfoForLinuxUser: getOsUserInfoForLinuxUser,
     getLinuxUserForSession: getLinuxUserForSession,
+    refreshVendorAuthEverywhere: opts.refreshVendorAuthEverywhere,
   });
 
   // --- Filesystem handler (delegated to project-filesystem.js) ---
@@ -2141,6 +2142,7 @@ function createProjectContext(opts) {
     listKnowledgeFiles: _knowledge.listKnowledgeFiles,
     refreshCapsuleCatalog: _capsuleCatalog.refreshSessions,
     getNotificationsModule: function () { return _notifications; },
+    refreshVendorAuth: _vendorLogin.refreshVendorAuth,
     getSchedules: _loop.getSchedules,
     importSchedule: _loop.importSchedule,
     removeSchedule: _loop.removeSchedule,

package/lib/sdk-message-processor.js

@@ -61,6 +61,20 @@ function attachMessageProcessor(ctx) {
     if (session._lastAuthEmit && (now - session._lastAuthEmit) < 5000) return;
     session._lastAuthEmit = now;
 
+    // Codex can leave a transient 401 in its app-server event stream after a
+    // successful device login. Confirm the CLI's current credential state
+    // before interrupting another session with a login modal.
+    var vendor = session.vendor || "claude";
+    yoke.invalidateAuthCache();
+    var authState = yoke.checkAuth();
+    if (authState[vendor]) {
+      sendAndRecord(session, {
+        type: "error",
+        text: "Authentication is available, but " + vendor + " reported an auth-like error. Try again.",
+      });
+      return;
+    }
+
     var authUser = session.ownerId ? usersModule.findUserById(session.ownerId) : null;
     var authLinuxUser = authUser && authUser.linuxUser ? authUser.linuxUser : null;
     var canAutoLogin = !usersModule.isMultiUser()
@@ -76,7 +90,7 @@ function attachMessageProcessor(ctx) {
     sendToSession(session, {
       type: "auth_required",
       text: authTitle,
-      vendor: session.vendor || "claude",
+      vendor: vendor,
       loginCommand: loginCommand,
       linuxUser: authLinuxUser,
       canAutoLogin: canAutoLogin,
@@ -88,7 +102,7 @@ function attachMessageProcessor(ctx) {
         slug: slug,
         sessionId: session.localId,
         ownerId: session.ownerId || null,
-        vendor: session.vendor || "claude",
+        vendor: vendor,
         loginCommand: loginCommand,
         linuxUser: authLinuxUser,
         canAutoLogin: canAutoLogin,

package/lib/server.js

@@ -1155,6 +1155,24 @@ function createServer(opts) {
   }
 
   // --- Project management ---
+  function refreshVendorAuthEverywhere(vendor, linuxUser) {
+    var refreshes = [];
+    projects.forEach(function (projectCtx) {
+      if (!projectCtx || typeof projectCtx.refreshVendorAuth !== "function") return;
+      try {
+        refreshes.push(Promise.resolve(projectCtx.refreshVendorAuth(vendor, linuxUser)).catch(function (err) {
+          console.error("[server] Cross-project " + vendor + " auth refresh failed:", err && err.message ? err.message : err);
+          return false;
+        }));
+      } catch (err) {
+        console.error("[server] Cross-project " + vendor + " auth refresh threw:", err && err.message ? err.message : err);
+      }
+    });
+    return Promise.all(refreshes).then(function (results) {
+      return results.some(function (refreshed) { return !!refreshed; });
+    });
+  }
+
   function addProject(cwd, slug, title, icon, projectOwnerId, worktreeMeta, extraOpts) {
     if (projects.has(slug)) return false;
     var extra = extraOpts || {};
@@ -1327,6 +1345,7 @@ function createServer(opts) {
       onDmMessage: handleDmMessage,
       broadcastAll: broadcastAll,
       notificationsModule: _globalNotifications,
+      refreshVendorAuthEverywhere: refreshVendorAuthEverywhere,
       getProject: function (s) { return projects.get(s) || null; },
       isUserOnline: isUserOnline,
     });

package/lib/yoke/adapters/codex.js

@@ -1943,6 +1943,23 @@ function createCodexAdapter(opts) {
       ]).then(function() { return true; });
     },
 
+    // A device login writes credentials for one OS identity. Refresh only
+    // that identity in OS-isolated deployments; single-user projects restart
+    // their sole app-server.
+    refreshAuthIdentity: function(linuxUser) {
+      if (!_runtimeLinuxUser && linuxUser) {
+        var userRuntime = _userRuntimes[linuxUser];
+        if (!userRuntime) return Promise.resolve(false);
+        return userRuntime.shutdown().then(function() {
+          delete _userRuntimes[linuxUser];
+          return true;
+        });
+      }
+      if (_runtimeLinuxUser && linuxUser !== _runtimeLinuxUser) return Promise.resolve(false);
+      if (_requiresLinuxUser) return Promise.resolve(false);
+      return adapter.shutdown();
+    },
+
     shutdownIfIdle: function(idleMs) {
       if (!_runtimeLinuxUser && Object.keys(_userRuntimes).length > 0) {
         return shutdownUserRuntimes("shutdownIfIdle", idleMs).then(function(results) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.6",
+  "version": "4.0.0-beta.8",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",