clay-server 4.0.0-beta.7 → 4.0.0-beta.8

package/lib/project-vendor-login.js

@@ -63,7 +63,8 @@ function looksLikeLoginSuccess(text) {
  *   sm, tm, adapters,
  *   send, sendTo,
  *   usersModule,
- *   getOsUserInfoForWs, getOsUserInfoForLinuxUser, getLinuxUserForSession
+ *   getOsUserInfoForWs, getOsUserInfoForLinuxUser, getLinuxUserForSession,
+ *   refreshVendorAuthEverywhere
  */
 function attachVendorLogin(ctx) {
   var slug = ctx.slug;
@@ -81,6 +82,7 @@ function attachVendorLogin(ctx) {
   var getOsUserInfoForWs = ctx.getOsUserInfoForWs;
   var getOsUserInfoForLinuxUser = ctx.getOsUserInfoForLinuxUser;
   var getLinuxUserForSession = ctx.getLinuxUserForSession;
+  var refreshVendorAuthEverywhere = ctx.refreshVendorAuthEverywhere;
 
   // vendor -> flow record. At most one live login terminal per vendor.
   var _flows = Object.create(null);
@@ -182,13 +184,17 @@ function attachVendorLogin(ctx) {
   // the credentials the login just wrote. Shared adapter instances (Claude) are
   // reused by every project, so tearing one down here would kill unrelated
   // sessions; those runtimes pick up new credentials on their own.
-  function refreshVendorAuth(vendor) {
+  function refreshVendorAuth(vendor, linuxUser) {
     var adapter = adapters[vendor];
     if (!adapter || typeof adapter.shutdown !== "function") return Promise.resolve(false);
     if (adapter.shared) {
       console.log("[vendor-login] " + vendor + " adapter is shared; skipping restart for " + slug);
       return Promise.resolve(false);
     }
+    if (typeof adapter.refreshAuthIdentity === "function") {
+      return Promise.resolve(adapter.refreshAuthIdentity(linuxUser || null));
+    }
+    if (linuxUser) return Promise.resolve(false);
     // adapter.shutdown() already fans out to every per-OS-user runtime it
     // created (shutdownUserRuntimes), so one call covers isolated setups too.
     return Promise.resolve()
@@ -214,7 +220,12 @@ function attachVendorLogin(ctx) {
     // result. Re-check before restarting the runtime, which will then read
     // the newly written credential file.
     if (succeeded) yoke.invalidateAuthCache();
-    var refresh = succeeded ? refreshVendorAuth(vendor) : Promise.resolve(false);
+    var refresh = Promise.resolve(false);
+    if (succeeded) {
+      refresh = typeof refreshVendorAuthEverywhere === "function"
+        ? refreshVendorAuthEverywhere(vendor, flow.linuxUser || null)
+        : refreshVendorAuth(vendor, flow.linuxUser || null);
+    }
     refresh.then(function (restarted) {
       discardFlow(vendor);
       closeFlowTerminal(flow);
@@ -396,6 +407,7 @@ function attachVendorLogin(ctx) {
     listFlows: listFlows,
     forgetTerminal: forgetTerminal,
     isLoginTerminal: isLoginTerminal,
+    refreshVendorAuth: refreshVendorAuth,
   };
 }
 

package/lib/project.js

@@ -1610,6 +1610,7 @@ function createProjectContext(opts) {
     getOsUserInfoForWs: getOsUserInfoForWs,
     getOsUserInfoForLinuxUser: getOsUserInfoForLinuxUser,
     getLinuxUserForSession: getLinuxUserForSession,
+    refreshVendorAuthEverywhere: opts.refreshVendorAuthEverywhere,
   });
 
   // --- Filesystem handler (delegated to project-filesystem.js) ---
@@ -2141,6 +2142,7 @@ function createProjectContext(opts) {
     listKnowledgeFiles: _knowledge.listKnowledgeFiles,
     refreshCapsuleCatalog: _capsuleCatalog.refreshSessions,
     getNotificationsModule: function () { return _notifications; },
+    refreshVendorAuth: _vendorLogin.refreshVendorAuth,
     getSchedules: _loop.getSchedules,
     importSchedule: _loop.importSchedule,
     removeSchedule: _loop.removeSchedule,

package/lib/server.js

@@ -1155,6 +1155,24 @@ function createServer(opts) {
   }
 
   // --- Project management ---
+  function refreshVendorAuthEverywhere(vendor, linuxUser) {
+    var refreshes = [];
+    projects.forEach(function (projectCtx) {
+      if (!projectCtx || typeof projectCtx.refreshVendorAuth !== "function") return;
+      try {
+        refreshes.push(Promise.resolve(projectCtx.refreshVendorAuth(vendor, linuxUser)).catch(function (err) {
+          console.error("[server] Cross-project " + vendor + " auth refresh failed:", err && err.message ? err.message : err);
+          return false;
+        }));
+      } catch (err) {
+        console.error("[server] Cross-project " + vendor + " auth refresh threw:", err && err.message ? err.message : err);
+      }
+    });
+    return Promise.all(refreshes).then(function (results) {
+      return results.some(function (refreshed) { return !!refreshed; });
+    });
+  }
+
   function addProject(cwd, slug, title, icon, projectOwnerId, worktreeMeta, extraOpts) {
     if (projects.has(slug)) return false;
     var extra = extraOpts || {};
@@ -1327,6 +1345,7 @@ function createServer(opts) {
       onDmMessage: handleDmMessage,
       broadcastAll: broadcastAll,
       notificationsModule: _globalNotifications,
+      refreshVendorAuthEverywhere: refreshVendorAuthEverywhere,
       getProject: function (s) { return projects.get(s) || null; },
       isUserOnline: isUserOnline,
     });

package/lib/yoke/adapters/codex.js

@@ -1943,6 +1943,23 @@ function createCodexAdapter(opts) {
       ]).then(function() { return true; });
     },
 
+    // A device login writes credentials for one OS identity. Refresh only
+    // that identity in OS-isolated deployments; single-user projects restart
+    // their sole app-server.
+    refreshAuthIdentity: function(linuxUser) {
+      if (!_runtimeLinuxUser && linuxUser) {
+        var userRuntime = _userRuntimes[linuxUser];
+        if (!userRuntime) return Promise.resolve(false);
+        return userRuntime.shutdown().then(function() {
+          delete _userRuntimes[linuxUser];
+          return true;
+        });
+      }
+      if (_runtimeLinuxUser && linuxUser !== _runtimeLinuxUser) return Promise.resolve(false);
+      if (_requiresLinuxUser) return Promise.resolve(false);
+      return adapter.shutdown();
+    },
+
     shutdownIfIdle: function(idleMs) {
       if (!_runtimeLinuxUser && Object.keys(_userRuntimes).length > 0) {
         return shutdownUserRuntimes("shutdownIfIdle", idleMs).then(function(results) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.7",
+  "version": "4.0.0-beta.8",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",