clay-server 5.1.0-beta.2 → 5.1.0

package/bin/cli.js

@@ -37,6 +37,7 @@ var { generateAuthToken } = require("../lib/server");
 var { enableMultiUser, disableMultiUser, hasAdmin, isMultiUser, getSetupCode } = require("../lib/users");
 var clayStudioCert = require("../lib/clay-studio-cert");
 var cliWordmark = require("../lib/cli-wordmark");
+var buildStartupProjects = require("../lib/startup-projects").buildStartupProjects;
 
 function openUrl(url) {
   try {
@@ -446,9 +447,6 @@ async function restartDaemonFromConfig() {
   var newConfig = Object.assign({}, lastConfig, {
     pid: null,
     port: targetPort,
-    projects: (lastConfig.projects || []).filter(function (p) {
-      return fs.existsSync(p.path);
-    })
   });
 
   ensureConfigDir();
@@ -1445,56 +1443,15 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
     return;
   }
 
-  var allProjects = [];
-  var usedSlugs = [];
-
-  // Load previous config to preserve per-project settings (visibility, allowedUsers)
   var prevConfig = loadConfig();
-  var prevProjectMap = {};
-  if (prevConfig && prevConfig.projects) {
-    for (var pi = 0; pi < prevConfig.projects.length; pi++) {
-      prevProjectMap[prevConfig.projects[pi].path] = prevConfig.projects[pi];
-    }
-  }
-
-  // Only include cwd if explicitly requested
+  var recentProjects = extraProjects || [];
   if (addCwd) {
-    var slug = generateSlug(cwd, []);
-    var cwdEntry = { path: cwd, slug: slug, addedAt: Date.now() };
-    // Restore title/icon from .clayrc if available
-    var cwdRc = loadClayrc();
-    var cwdRecent = cwdRc.recentProjects || [];
-    for (var cr = 0; cr < cwdRecent.length; cr++) {
-      if (cwdRecent[cr].path === cwd) {
-        if (cwdRecent[cr].title) cwdEntry.title = cwdRecent[cr].title;
-        if (cwdRecent[cr].icon) cwdEntry.icon = cwdRecent[cr].icon;
-        break;
-      }
-    }
-    // Restore project-level settings from previous config
-    if (prevProjectMap[cwd]) {
-      cwdEntry = Object.assign({}, prevProjectMap[cwd], cwdEntry);
-    }
-    allProjects.push(cwdEntry);
-    usedSlugs.push(slug);
-  }
-
-  // Add restored projects (from ~/.clayrc)
-  if (extraProjects && extraProjects.length > 0) {
-    for (var ep = 0; ep < extraProjects.length; ep++) {
-      var rp = extraProjects[ep];
-      if (rp.path === cwd) continue; // skip if same as cwd
-      if (!fs.existsSync(rp.path)) continue; // skip missing directories
-      var rpSlug = generateSlug(rp.path, usedSlugs);
-      usedSlugs.push(rpSlug);
-      var rpEntry = { path: rp.path, slug: rpSlug, title: rp.title || undefined, icon: rp.icon || undefined, addedAt: rp.addedAt || Date.now() };
-      // Restore project-level settings from previous config
-      if (prevProjectMap[rp.path]) {
-        rpEntry = Object.assign({}, prevProjectMap[rp.path], rpEntry);
-      }
-      allProjects.push(rpEntry);
-    }
+    var cwdRecent = (loadClayrc().recentProjects || []).filter(function (p) { return p.path === cwd; });
+    recentProjects = cwdRecent.concat(recentProjects);
   }
+  var allProjects = buildStartupProjects(prevConfig, recentProjects, {
+    cwd: cwd, addCwd: addCwd, existsSync: fs.existsSync, generateSlug: generateSlug,
+  });
 
   var config = Object.assign({}, prevConfig || {}, {
     pid: null,
@@ -1629,49 +1586,10 @@ async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
     return;
   }
 
-  var slug = generateSlug(cwd, []);
-  var cwdDevEntry = { path: cwd, slug: slug, addedAt: Date.now() };
-
-  // Load previous config to preserve per-project settings (visibility, allowedUsers)
   var prevDevConfig = loadConfig();
-  var prevDevProjectMap = {};
-  if (prevDevConfig && prevDevConfig.projects) {
-    for (var pdi = 0; pdi < prevDevConfig.projects.length; pdi++) {
-      prevDevProjectMap[prevDevConfig.projects[pdi].path] = prevDevConfig.projects[pdi];
-    }
-  }
-
-  // Restore previous projects
-  var rc = loadClayrc();
-  var restorable = (rc.recentProjects || []).filter(function (p) {
-    return p.path !== cwd && fs.existsSync(p.path);
+  var allProjects = buildStartupProjects(prevDevConfig, loadClayrc().recentProjects || [], {
+    cwd: cwd, addCwd: true, existsSync: fs.existsSync, generateSlug: generateSlug,
   });
-  // Restore title/icon for cwd from .clayrc
-  var rcAll = rc.recentProjects || [];
-  for (var ci = 0; ci < rcAll.length; ci++) {
-    if (rcAll[ci].path === cwd) {
-      if (rcAll[ci].title) cwdDevEntry.title = rcAll[ci].title;
-      if (rcAll[ci].icon) cwdDevEntry.icon = rcAll[ci].icon;
-      break;
-    }
-  }
-  // Restore access settings for cwd from previous config
-  if (prevDevProjectMap[cwd]) {
-    cwdDevEntry = Object.assign({}, prevDevProjectMap[cwd], cwdDevEntry);
-  }
-  var allProjects = [cwdDevEntry];
-  var usedSlugs = [slug];
-  for (var ri = 0; ri < restorable.length; ri++) {
-    var rp = restorable[ri];
-    var rpSlug = generateSlug(rp.path, usedSlugs);
-    usedSlugs.push(rpSlug);
-    var rpDevEntry = { path: rp.path, slug: rpSlug, title: rp.title || undefined, icon: rp.icon || undefined, addedAt: rp.addedAt || Date.now() };
-    // Restore project-level settings from previous config
-    if (prevDevProjectMap[rp.path]) {
-      rpDevEntry = Object.assign({}, prevDevProjectMap[rp.path], rpDevEntry);
-    }
-    allProjects.push(rpDevEntry);
-  }
 
   var config = Object.assign({}, prevDevConfig || {}, {
     pid: null,

package/lib/builtin-mates.js

@@ -156,7 +156,7 @@ var BUILTIN_MATES = [
 ];
 
 // ---------------------------------------------------------------------------
-// ALLY CLAUDE.md template
+// ALLY AGENTS.md template
 // ---------------------------------------------------------------------------
 
 var ALLY_TEMPLATE =
@@ -245,7 +245,7 @@ var ALLY_TEMPLATE =
   "- Do not promote transient information or emotional states.\n";
 
 // ---------------------------------------------------------------------------
-// CLAY CLAUDE.md template (host agent — the app itself answers)
+// CLAY AGENTS.md template (host agent — the app itself answers)
 // ---------------------------------------------------------------------------
 
 var CLAY_TEMPLATE =
@@ -321,7 +321,7 @@ var CLAY_TEMPLATE =
   "After that, jump straight into search. No more meta-conversation.\n";
 
 // ---------------------------------------------------------------------------
-// ARCH CLAUDE.md template
+// ARCH AGENTS.md template
 // ---------------------------------------------------------------------------
 
 var ARCH_TEMPLATE =
@@ -392,7 +392,7 @@ var ARCH_TEMPLATE =
   "If nothing is there, work without it and learn through the conversation.\n";
 
 // ---------------------------------------------------------------------------
-// RUSH CLAUDE.md template
+// RUSH AGENTS.md template
 // ---------------------------------------------------------------------------
 
 var RUSH_TEMPLATE =
@@ -459,7 +459,7 @@ var RUSH_TEMPLATE =
   "and deadlines. Use what is available. If nothing is there, work without it.\n";
 
 // ---------------------------------------------------------------------------
-// WARD CLAUDE.md template
+// WARD AGENTS.md template
 // ---------------------------------------------------------------------------
 
 var WARD_TEMPLATE =
@@ -527,7 +527,7 @@ var WARD_TEMPLATE =
   "tech stack, and known risk areas. Use what is available. If nothing is there, work without it.\n";
 
 // ---------------------------------------------------------------------------
-// PIXEL CLAUDE.md template
+// PIXEL AGENTS.md template
 // ---------------------------------------------------------------------------
 
 var PIXEL_TEMPLATE =
@@ -599,7 +599,7 @@ var PIXEL_TEMPLATE =
   "target audience, and UX decisions. Use what is available. If nothing is there, work without it.\n";
 
 // ---------------------------------------------------------------------------
-// BUZZ CLAUDE.md template
+// BUZZ AGENTS.md template
 // ---------------------------------------------------------------------------
 
 var BUZZ_TEMPLATE =

package/lib/daemon-settings.js

@@ -0,0 +1,11 @@
+// Persist before publishing a setting to live daemon state.
+function saveDaemonSetting(config, key, value, saveConfig) {
+  var overrides = {}; overrides[key] = value;
+  var next = Object.assign({}, config, overrides);
+  if (value === undefined) delete next[key];
+  saveConfig(next);
+  if (value === undefined) delete config[key];
+  Object.assign(config, next);
+  return next;
+}
+module.exports = { saveDaemonSetting: saveDaemonSetting };

package/lib/daemon.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+var saveDaemonSetting = require("./daemon-settings").saveDaemonSetting;
 
 // --- Node version check ---
 var nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
@@ -72,9 +73,7 @@ if (projectLogContext.initializeProjectKnowledge(config)) {
 }
 
 // --- OS users mode: check required system dependencies ---
-// Supplementary-group inheritance (issue #367): default on so sessions behave
-// like a normal login; operators can disable via config / the settings toggle.
-osUsersMod.setInheritGroups(config.inheritGroups !== false);
+// User-switched processes inherit the account groups, like a normal login.
 if (config.osUsers) {
   var checkExec = require("child_process").execFileSync;
   var missing = [];
@@ -86,11 +85,7 @@ if (config.osUsers) {
     console.error("[daemon] Install with:  sudo apt install " + missing.map(function (m) { return m.split(" ")[0]; }).join(" "));
     process.exit(78); // EX_CONFIG
   }
-  if (config.inheritGroups !== false) {
-    console.log("[daemon] Sessions inherit each user's supplementary groups (docker, etc.); disable in Settings > User Groups.");
-  } else {
-    console.log("[daemon] Sessions run with primary group only (supplementary groups dropped); enable in Settings > User Groups.");
-  }
+  console.log("[daemon] Sessions inherit each user's supplementary groups when setpriv is available.");
 }
 
 // --- TLS ---
@@ -637,12 +632,7 @@ var relay = createServer({
     return { envrc: config.sharedEnv || "" };
   },
   onSetSharedEnv: function (envrc) {
-    if (envrc) {
-      config.sharedEnv = envrc;
-    } else {
-      delete config.sharedEnv;
-    }
-    saveConfig(config);
+    saveDaemonSetting(config, "sharedEnv", envrc || undefined, saveConfig);
     return { ok: true };
   },
   onGetServerDefaultEffort: function () {
@@ -812,7 +802,6 @@ var relay = createServer({
       keepAwake: !!config.keepAwake,
       autoContinueOnRateLimit: !!config.autoContinueOnRateLimit,
       osUsers: !!config.osUsers,
-      inheritGroups: config.inheritGroups !== false,
       chatLayout: config.chatLayout || "channel",
       matesEnabled: config.matesEnabled === true,
       capsulesEnabled: config.capsulesEnabled === true,
@@ -827,25 +816,18 @@ var relay = createServer({
   onSetImageRetention: function (days) {
     var d = parseInt(days, 10);
     if (isNaN(d) || d < 0) d = 7;
-    config.imageRetentionDays = d;
-    saveConfig(config);
+    saveDaemonSetting(config, "imageRetentionDays", d, saveConfig);
     console.log("[daemon] Image retention:", d === 0 ? "forever" : d + " days");
     return { ok: true, days: d };
   },
   onSetUpdateChannel: function (channel) {
-    config.updateChannel = channel === "beta" ? "beta" : "stable";
-    saveConfig(config);
+    saveDaemonSetting(config, "updateChannel", channel === "beta" ? "beta" : "stable", saveConfig);
     console.log("[daemon] Update channel:", config.updateChannel, "(web)");
     return { ok: true, updateChannel: config.updateChannel };
   },
   onSetPin: function (pin) {
-    if (pin) {
-      config.pinHash = generateAuthToken(pin);
-    } else {
-      config.pinHash = null;
-    }
+    saveDaemonSetting(config, "pinHash", pin ? generateAuthToken(pin) : null, saveConfig);
     relay.setAuthToken(config.pinHash);
-    saveConfig(config);
     console.log("[daemon] PIN", pin ? "set" : "removed", "(web)");
     return { ok: true, pinEnabled: !!config.pinHash };
   },
@@ -921,8 +903,7 @@ var relay = createServer({
   },
   onSetKeepAwake: function (value) {
     var want = !!value;
-    config.keepAwake = want;
-    saveConfig(config);
+    saveDaemonSetting(config, "keepAwake", want, saveConfig);
     if (want && !caffeinateProc && process.platform === "darwin") {
       try {
         var { spawn: spawnCaff } = require("child_process");
@@ -936,16 +917,6 @@ var relay = createServer({
     console.log("[daemon] Keep awake:", want, "(web)");
     return { ok: true, keepAwake: want };
   },
-  onSetInheritGroups: function (value) {
-    var want = !!value;
-    config.inheritGroups = want;
-    saveConfig(config);
-    // Apply live so subsequent session/terminal spawns pick it up without a
-    // daemon restart; already-running sessions keep their current groups.
-    osUsersMod.setInheritGroups(want);
-    console.log("[daemon] Inherit supplementary groups:", want, "(web)");
-    return { ok: true, inheritGroups: want };
-  },
   onShutdown: function () {
     console.log("[daemon] Shutdown requested via web UI");
     gracefulShutdown();

package/lib/linear-store.js

@@ -19,34 +19,61 @@ function attachLinearStore(root) {
     catch (error) { if (error.code !== 'EEXIST') throw error; }
     return fs.readFileSync(file);
   }
-  function key(owner) {
+  function record(owner, id) {
     var data = read(owner);
+    return !id || id === "default" ? data : Object.hasOwn(data.connections || {}, id) ? data.connections[id] : {};
+  }
+  function key(owner, id) {
+    var data = record(owner, id);
     if (!data.secret) return null;
     var parts = data.secret.split('.').map(function (part) { return Buffer.from(part, 'base64'); });
     var cipher = crypto.createDecipheriv('aes-256-gcm', masterKey(), parts[0]);
-    cipher.setAAD(Buffer.from(owner)); cipher.setAuthTag(parts[1]);
+    cipher.setAAD(Buffer.from(id && id !== 'default' ? owner + ':' + id : owner)); cipher.setAuthTag(parts[1]);
     return Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8');
   }
-  function view(owner) {
-    var data = read(owner);
+  function view(owner, id) {
+    var data = record(owner, id);
     return { connected: !!data.secret, workspace: data.workspace || null, revision: data.revision || null };
   }
-  function save(owner, secret, workspace) {
+  function save(owner, secret, workspace, id, name) {
+    if (id && (!/^[a-zA-Z0-9_-]{1,64}$/.test(id) || ['__proto__', 'constructor', 'prototype'].indexOf(id) >= 0)) throw new Error("Invalid connection.");
+    var previous = read(owner);
     var file = filename(owner), data = { revision: crypto.randomBytes(16).toString('hex') };
     if (secret !== null) {
       if (typeof secret !== 'string' || !secret.trim() || secret.length > 4096 || /[\r\n]/.test(secret)) throw new Error('Enter a valid Linear API key.');
       var iv = crypto.randomBytes(12), cipher = crypto.createCipheriv('aes-256-gcm', masterKey(), iv);
-      cipher.setAAD(Buffer.from(owner));
+      cipher.setAAD(Buffer.from(id && id !== 'default' ? owner + ':' + id : owner));
       var bytes = Buffer.concat([cipher.update(secret.trim(), 'utf8'), cipher.final()]);
       data.secret = [iv, cipher.getAuthTag(), bytes].map(function (part) { return part.toString('base64'); }).join('.');
       data.workspace = workspace;
     }
+    if (name !== undefined) {
+      if (typeof name !== 'string' || !name.trim() || name.trim().length > 80) throw new Error('Enter a connection name of up to 80 characters.');
+      data.name = name.trim();
+    } else data.name = record(owner, id).name;
+    if (id && id !== 'default') {
+      previous.connections = previous.connections || {};
+      if (secret === null) delete previous.connections[id];
+      else {
+        if (!previous.connections[id] && Object.keys(previous.connections).length >= 30) throw new Error('Connection limit reached.');
+        previous.connections[id] = data;
+      }
+      data = previous;
+    } else data.connections = previous.connections;
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     var temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
     try { fs.writeFileSync(temp, JSON.stringify(data), { mode: 0o600 }); fs.renameSync(temp, file); }
     finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
-    return view(owner);
+    return view(owner, id);
+  }
+  function list(owner) {
+    var data = read(owner), entries = [];
+    if (data.secret) entries.push(Object.assign({ id: 'default', name: data.name || 'Existing connection', legacy: true }, view(owner)));
+    Object.keys(data.connections || {}).forEach(function (id) {
+      entries.push(Object.assign({ id: id, name: data.connections[id].name || 'Linear', legacy: false }, view(owner, id)));
+    });
+    return entries;
   }
-  return { key: key, view: view, save: save };
+  return { key: key, view: view, save: save, list: list };
 }
 module.exports = { attachLinearStore: attachLinearStore };

package/lib/mate-identity-file.js

@@ -0,0 +1,39 @@
+// Resolve the canonical Mate identity without overwriting either document.
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+
+function regularFile(file) {
+  try {
+    var stat = fs.lstatSync(file);
+    if (!stat.isFile()) throw new Error('Mate identity must be a regular file: ' + file);
+    return stat;
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function resolveMateIdentityFile(directory) {
+  var canonical = path.join(directory, 'AGENTS.md');
+  var legacy = path.join(directory, 'CLAUDE.md');
+  var current = regularFile(canonical);
+  if (!regularFile(legacy)) return canonical;
+  if (!current) {
+    // Exclusive linking preserves owner, mode and bytes and never replaces a
+    // concurrently created canonical file. Unlink only after publication.
+    try { fs.linkSync(legacy, canonical); }
+    catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      return resolveMateIdentityFile(directory);
+    }
+  } else if (fs.statSync(canonical).ino !== fs.statSync(legacy).ino) {
+    // Preserve a conflicting legacy document outside instruction discovery.
+    var backup = path.join(directory, '.identity-legacy-' + crypto.randomBytes(12).toString('hex') + '.md');
+    fs.linkSync(legacy, backup);
+  }
+  fs.unlinkSync(legacy);
+  return canonical;
+}
+
+module.exports = {resolveMateIdentityFile: resolveMateIdentityFile};

package/lib/mate-knowledge-sync.js

@@ -12,7 +12,7 @@
 // call idempotent and makes deletions and rewrites work without the call site
 // having to describe what changed.
 //
-// Identity is never mirrored. CLAUDE.md, base-template.md, identity-backup.md,
+// Identity is never mirrored. AGENTS.md, legacy CLAUDE.md, base-template.md, identity-backup.md,
 // and identity-history.jsonl define who a Mate is and remain canonical files.
 // Sticky notes are a separate attention layer and are excluded too.
 

package/lib/mate-ready-creation.js

@@ -1,3 +1,4 @@
+var resolveMateIdentityFile = require('./mate-identity-file').resolveMateIdentityFile;
 // Atomic finalization of an interviewed Mate. No placeholder is exposed unless
 // the complete identity has passed validation and is ready to register.
 
@@ -55,7 +56,7 @@ function createReadyMate(mates, mateCtx, definition) {
       autonomy: ready.autonomy,
     });
     var mateDir = mates.getMateDir(mateCtx, mate.id);
-    var identityPath = path.join(mateDir, "CLAUDE.md");
+    var identityPath = resolveMateIdentityFile(mateDir);
     fs.writeFileSync(identityPath, ready.identityMarkdown + "\n");
     mates.enforceAllSections(identityPath, { ctx: mateCtx, mateId: mate.id });
     fs.mkdirSync(path.join(mateDir, "knowledge"), { recursive: true });

package/lib/mates-identity.js

@@ -2,7 +2,7 @@
  * Mates identity module -- Identity extraction, backup, and change tracking.
  *
  * Manages the boundary between a mate's user-authored identity and
- * system-managed sections in CLAUDE.md.
+ * system-managed sections in AGENTS.md.
  * Extracted from mates.js to keep module sizes manageable.
  */
 
@@ -18,7 +18,7 @@ var IDENTITY_MIN_LENGTH = 50;
 /**
  * Build the capabilities section for a primary mate.
  * Injected as a system section so it auto-updates with code changes
- * without touching the mate's identity in CLAUDE.md.
+ * without touching the mate's identity in AGENTS.md.
  */
 function buildPrimaryCapabilitiesSection(mate) {
   if (!mate || !mate.primary) return "";
@@ -52,9 +52,9 @@ function buildPrimaryCapabilitiesSection(mate) {
 }
 
 /**
- * Extract identity content from a CLAUDE.md string.
+ * Extract identity content from a AGENTS.md string.
  * Identity is everything before the first system marker.
- * @param {string} content - full CLAUDE.md content
+ * @param {string} content - full AGENTS.md content
  * @param {string[]} allMarkers - array of all system marker strings
  */
 function extractIdentity(content, allMarkers) {

package/lib/mates-prompts.js

@@ -1,5 +1,5 @@
 /**
- * Mates prompts module -- System section enforcers for mate CLAUDE.md files.
+ * Mates prompts module -- System section enforcers for mate AGENTS.md files.
  *
  * Each enforcer manages a specific system-managed section (team awareness,
  * session memory, sticky notes, project registry, debate awareness).
@@ -20,7 +20,7 @@ var TEAM_SECTION =
   "**This section is managed by the system and cannot be removed.**\n\n" +
   "You are one of several AI Mates in this workspace. Your teammates and their profiles are listed in `../mates.json`. " +
   "Each teammate's identity and working style is described in their own directory:\n\n" +
-  "- `../{mate_id}/CLAUDE.md` -- their identity, personality, and working style\n" +
+  "- `../{mate_id}/AGENTS.md` -- their identity, personality, and working style\n" +
   "- `../{mate_id}/mate.yaml` -- their metadata (name, role, status, activities)\n" +
   "- `../common-knowledge.json` -- shared knowledge registry; files listed here are readable by all mates\n\n" +
   "Check the team registry when it would be relevant to know who else is available or what they do. " +
@@ -31,6 +31,7 @@ var SESSION_MEMORY_MARKER = "<!-- SESSION_MEMORY_MANAGED_BY_SYSTEM -->";
 var SESSION_MEMORY_SECTION =
   "\n\n" + SESSION_MEMORY_MARKER + "\n" +
   "## Session Memory\n\n" +
+  "Your identity is stored in `AGENTS.md` in your Mate directory. Read and edit that file when reshaping your identity; do not create a separate `CLAUDE.md`.\n\n" +
   "**This section is managed by the system and cannot be removed.**\n\n" +
   "Your `knowledge/memory-summary.md` file contains your compressed long-term memory, " +
   "automatically maintained across sessions. Refer to it for context about past " +
@@ -115,7 +116,7 @@ function buildTeamSection(ctx, currentMateId, loadMates) {
 
   section += "\n" +
     "Each teammate's full identity is in their own directory:\n\n" +
-    "- `../{mate_id}/CLAUDE.md` -- identity, personality, working style\n" +
+    "- `../{mate_id}/AGENTS.md` -- identity, personality, working style\n" +
     "- `../{mate_id}/mate.yaml` -- metadata (name, role, status, activities)\n" +
     "- `../common-knowledge.json` -- shared knowledge readable by all mates\n\n" +
     "Use the **ID** (not the name) when referencing teammates in structured data. " +

package/lib/mates.js

@@ -1,3 +1,4 @@
+var resolveMateIdentityFile = require('./mate-identity-file').resolveMateIdentityFile;
 var fs = require("fs");
 var path = require("path");
 var crypto = require("crypto");
@@ -161,7 +162,7 @@ function createMate(ctx, seedData) {
   yaml += "model: " + JSON.stringify(seedData.model || null) + "\n";
   fs.writeFileSync(path.join(mateDir, "mate.yaml"), yaml);
 
-  // Write initial CLAUDE.md (will be replaced by interview)
+  // Write initial AGENTS.md (will be replaced by interview)
   var claudeMd = "# Mate Identity\n\n";
   claudeMd += "This mate is currently being interviewed. Identity will be generated after the interview.\n\n";
   claudeMd += "## Seed Data\n\n";
@@ -176,7 +177,7 @@ function createMate(ctx, seedData) {
   claudeMd += TEAM_SECTION;
   claudeMd += SESSION_MEMORY_SECTION;
   claudeMd += crisisSafety.getSection();
-  fs.writeFileSync(path.join(mateDir, "CLAUDE.md"), claudeMd);
+  fs.writeFileSync(resolveMateIdentityFile(mateDir), claudeMd);
 
   // Log creation (identity is placeholder, will be replaced by interview)
   logIdentityChange(mateDir, "create_custom", initialIdentity, "");
@@ -344,7 +345,7 @@ function migrateLegacyMates() {
 }
 
 /**
- * Strip all system sections from CLAUDE.md content, returning only identity.
+ * Strip all system sections from AGENTS.md content, returning only identity.
  */
 function stripAllSystemSections(content) {
   return extractIdentity(content);
@@ -354,10 +355,10 @@ function stripAllSystemSections(content) {
 var _warnedPaths = {};
 
 /**
- * Atomic enforce: read CLAUDE.md once, enforce all system sections, write once.
+ * Atomic enforce: read AGENTS.md once, enforce all system sections, write once.
  * Includes identity backup, validation, and change tracking.
  * Returns true if the file was modified, false if already correct.
- * @param {string} filePath - path to CLAUDE.md
+ * @param {string} filePath - path to AGENTS.md
  * @param {object} opts - optional { ctx, mateId } for dynamic team section
  */
 function enforceAllSections(filePath, opts) {
@@ -529,7 +530,7 @@ function createBuiltinMate(ctx, builtinKey) {
   yaml += "autonomy: " + (seedData.autonomy || "always_ask") + "\n";
   fs.writeFileSync(path.join(mateDir, "mate.yaml"), yaml);
 
-  // Write CLAUDE.md with full template + system sections
+  // Write AGENTS.md with full template + system sections
   var claudeMd = def.getClaudeMd();
   var builtinIdentity = claudeMd.trimEnd();
   claudeMd += TEAM_SECTION;
@@ -537,7 +538,7 @@ function createBuiltinMate(ctx, builtinKey) {
   claudeMd += STICKY_NOTES_SECTION;
   claudeMd += DEBATE_AWARENESS_SECTION;
   claudeMd += crisisSafety.getSection();
-  fs.writeFileSync(path.join(mateDir, "CLAUDE.md"), claudeMd);
+  fs.writeFileSync(resolveMateIdentityFile(mateDir), claudeMd);
 
   // Backup identity and log creation
   backupIdentity(mateDir, builtinIdentity);
@@ -621,7 +622,7 @@ function syncArchivedBuiltinMates(ctx) {
  *
  * What gets synced:
  * - Metadata: bio, name, profile, globalSearch, primary flag
- * - CLAUDE.md identity: re-applied when templateVersion changes
+ * - AGENTS.md identity: re-applied when templateVersion changes
  * - templateVersion is stored on the mate object to track updates
  *
  * What is NOT synced (regular builtin mates):
@@ -671,10 +672,10 @@ function syncPrimaryMates(ctx) {
       }
     }
 
-    // --- Sync CLAUDE.md identity (only when templateVersion changes) ---
+    // --- Sync AGENTS.md identity (only when templateVersion changes) ---
     // Uses 3-way comparison to preserve user/Ally modifications:
     // - base-template.md = the template that was last synced (what code wrote)
-    // - current identity = what's in CLAUDE.md now (may have been modified)
+    // - current identity = what's in AGENTS.md now (may have been modified)
     // - new template = latest code definition
     //
     // If current identity === old base → user didn't touch it → safe to replace
@@ -684,7 +685,7 @@ function syncPrimaryMates(ctx) {
 
     if (latestVersion > currentVersion) {
       var mateDir = getMateDir(ctx, mate.id);
-      var claudePath = path.join(mateDir, "CLAUDE.md");
+      var claudePath = resolveMateIdentityFile(mateDir);
       var basePath = path.join(mateDir, "knowledge", "base-template.md");
       var latestIdentity = def.getClaudeMd().trimEnd();
 

package/lib/os-users.js

@@ -17,20 +17,11 @@ function isSafeLinuxUsername(username) {
 // --- Supplementary group inheritance (issue #367) ---
 // Node's child_process { uid, gid } options call setuid/setgid but never
 // initgroups(), so spawned sessions drop all supplementary groups (docker,
-// video, wheel, ...). When inheritGroups is enabled we route the spawn through
+// video, wheel, ...). Route user-switched spawns through
 // `setpriv --init-groups` so the child gets the same groups as a normal login.
-var _inheritGroups = true; // default: behave like a normal login shell
 var _setprivAvail = null;
 var _warnedNoSetpriv = false;
 
-function setInheritGroups(value) {
-  _inheritGroups = !!value;
-}
-
-function getInheritGroups() {
-  return _inheritGroups;
-}
-
 function setprivAvailable() {
   if (_setprivAvail !== null) return _setprivAvail;
   try {
@@ -50,7 +41,7 @@ function setprivAvailable() {
  * spawn()/execFileSync()/pty.spawn().
  *
  * - Same-user spawns (no uid/gid in options) are returned unchanged.
- * - When inheritGroups is disabled, or setpriv is unavailable, falls back to
+ * - When setpriv is unavailable, falls back to
  *   Node's uid/gid options (primary group only) so behavior degrades safely.
  * Requires the parent process to be root, which is the case in os-users mode.
  */
@@ -62,7 +53,7 @@ function wrapSpawnAsUser(command, args, options, setprivCheck) {
   if (uid == null || gid == null) return { command: command, args: args, options: options };
 
   var hasSetpriv = typeof setprivCheck === "function" ? setprivCheck() : setprivAvailable();
-  if (_inheritGroups && hasSetpriv) {
+  if (hasSetpriv) {
     var wrappedArgs = ["--reuid", String(uid), "--regid", String(gid), "--init-groups", "--", command].concat(args);
     var newOpts = Object.assign({}, options);
     delete newOpts.uid;
@@ -70,9 +61,9 @@ function wrapSpawnAsUser(command, args, options, setprivCheck) {
     return { command: "setpriv", args: wrappedArgs, options: newOpts };
   }
 
-  if (_inheritGroups && !_warnedNoSetpriv) {
+  if (!_warnedNoSetpriv) {
     _warnedNoSetpriv = true;
-    console.warn("[os-users] inheritGroups enabled but `setpriv` not found; supplementary groups will be dropped. Install util-linux to restore them.");
+    console.warn("[os-users] `setpriv` not found; supplementary groups will be dropped. Install util-linux to restore them.");
   }
   return { command: command, args: args, options: options };
 }
@@ -673,8 +664,6 @@ module.exports = {
   grantAllUsersAccess: grantAllUsersAccess,
   installClaudeCli: installClaudeCli,
   claudeAvailableForUser: claudeAvailableForUser,
-  setInheritGroups: setInheritGroups,
-  getInheritGroups: getInheritGroups,
   wrapSpawnAsUser: wrapSpawnAsUser,
   deactivateLinuxUser: deactivateLinuxUser,
   ensureProjectsDir: ensureProjectsDir,