clay-server 5.1.0-beta.2 → 6.0.0-beta.1

package/bin/cli.js

@@ -37,6 +37,7 @@ var { generateAuthToken } = require("../lib/server");
 var { enableMultiUser, disableMultiUser, hasAdmin, isMultiUser, getSetupCode } = require("../lib/users");
 var clayStudioCert = require("../lib/clay-studio-cert");
 var cliWordmark = require("../lib/cli-wordmark");
+var buildStartupProjects = require("../lib/startup-projects").buildStartupProjects;
 
 function openUrl(url) {
   try {
@@ -446,9 +447,6 @@ async function restartDaemonFromConfig() {
   var newConfig = Object.assign({}, lastConfig, {
     pid: null,
     port: targetPort,
-    projects: (lastConfig.projects || []).filter(function (p) {
-      return fs.existsSync(p.path);
-    })
   });
 
   ensureConfigDir();
@@ -1445,56 +1443,15 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
     return;
   }
 
-  var allProjects = [];
-  var usedSlugs = [];
-
-  // Load previous config to preserve per-project settings (visibility, allowedUsers)
   var prevConfig = loadConfig();
-  var prevProjectMap = {};
-  if (prevConfig && prevConfig.projects) {
-    for (var pi = 0; pi < prevConfig.projects.length; pi++) {
-      prevProjectMap[prevConfig.projects[pi].path] = prevConfig.projects[pi];
-    }
-  }
-
-  // Only include cwd if explicitly requested
+  var recentProjects = extraProjects || [];
   if (addCwd) {
-    var slug = generateSlug(cwd, []);
-    var cwdEntry = { path: cwd, slug: slug, addedAt: Date.now() };
-    // Restore title/icon from .clayrc if available
-    var cwdRc = loadClayrc();
-    var cwdRecent = cwdRc.recentProjects || [];
-    for (var cr = 0; cr < cwdRecent.length; cr++) {
-      if (cwdRecent[cr].path === cwd) {
-        if (cwdRecent[cr].title) cwdEntry.title = cwdRecent[cr].title;
-        if (cwdRecent[cr].icon) cwdEntry.icon = cwdRecent[cr].icon;
-        break;
-      }
-    }
-    // Restore project-level settings from previous config
-    if (prevProjectMap[cwd]) {
-      cwdEntry = Object.assign({}, prevProjectMap[cwd], cwdEntry);
-    }
-    allProjects.push(cwdEntry);
-    usedSlugs.push(slug);
-  }
-
-  // Add restored projects (from ~/.clayrc)
-  if (extraProjects && extraProjects.length > 0) {
-    for (var ep = 0; ep < extraProjects.length; ep++) {
-      var rp = extraProjects[ep];
-      if (rp.path === cwd) continue; // skip if same as cwd
-      if (!fs.existsSync(rp.path)) continue; // skip missing directories
-      var rpSlug = generateSlug(rp.path, usedSlugs);
-      usedSlugs.push(rpSlug);
-      var rpEntry = { path: rp.path, slug: rpSlug, title: rp.title || undefined, icon: rp.icon || undefined, addedAt: rp.addedAt || Date.now() };
-      // Restore project-level settings from previous config
-      if (prevProjectMap[rp.path]) {
-        rpEntry = Object.assign({}, prevProjectMap[rp.path], rpEntry);
-      }
-      allProjects.push(rpEntry);
-    }
+    var cwdRecent = (loadClayrc().recentProjects || []).filter(function (p) { return p.path === cwd; });
+    recentProjects = cwdRecent.concat(recentProjects);
   }
+  var allProjects = buildStartupProjects(prevConfig, recentProjects, {
+    cwd: cwd, addCwd: addCwd, existsSync: fs.existsSync, generateSlug: generateSlug,
+  });
 
   var config = Object.assign({}, prevConfig || {}, {
     pid: null,
@@ -1629,49 +1586,10 @@ async function devMode(mode, keepAwake, existingPinHash, wantOsUsers) {
     return;
   }
 
-  var slug = generateSlug(cwd, []);
-  var cwdDevEntry = { path: cwd, slug: slug, addedAt: Date.now() };
-
-  // Load previous config to preserve per-project settings (visibility, allowedUsers)
   var prevDevConfig = loadConfig();
-  var prevDevProjectMap = {};
-  if (prevDevConfig && prevDevConfig.projects) {
-    for (var pdi = 0; pdi < prevDevConfig.projects.length; pdi++) {
-      prevDevProjectMap[prevDevConfig.projects[pdi].path] = prevDevConfig.projects[pdi];
-    }
-  }
-
-  // Restore previous projects
-  var rc = loadClayrc();
-  var restorable = (rc.recentProjects || []).filter(function (p) {
-    return p.path !== cwd && fs.existsSync(p.path);
+  var allProjects = buildStartupProjects(prevDevConfig, loadClayrc().recentProjects || [], {
+    cwd: cwd, addCwd: true, existsSync: fs.existsSync, generateSlug: generateSlug,
   });
-  // Restore title/icon for cwd from .clayrc
-  var rcAll = rc.recentProjects || [];
-  for (var ci = 0; ci < rcAll.length; ci++) {
-    if (rcAll[ci].path === cwd) {
-      if (rcAll[ci].title) cwdDevEntry.title = rcAll[ci].title;
-      if (rcAll[ci].icon) cwdDevEntry.icon = rcAll[ci].icon;
-      break;
-    }
-  }
-  // Restore access settings for cwd from previous config
-  if (prevDevProjectMap[cwd]) {
-    cwdDevEntry = Object.assign({}, prevDevProjectMap[cwd], cwdDevEntry);
-  }
-  var allProjects = [cwdDevEntry];
-  var usedSlugs = [slug];
-  for (var ri = 0; ri < restorable.length; ri++) {
-    var rp = restorable[ri];
-    var rpSlug = generateSlug(rp.path, usedSlugs);
-    usedSlugs.push(rpSlug);
-    var rpDevEntry = { path: rp.path, slug: rpSlug, title: rp.title || undefined, icon: rp.icon || undefined, addedAt: rp.addedAt || Date.now() };
-    // Restore project-level settings from previous config
-    if (prevDevProjectMap[rp.path]) {
-      rpDevEntry = Object.assign({}, prevDevProjectMap[rp.path], rpDevEntry);
-    }
-    allProjects.push(rpDevEntry);
-  }
 
   var config = Object.assign({}, prevDevConfig || {}, {
     pid: null,

package/lib/daemon-settings.js

@@ -0,0 +1,11 @@
+// Persist before publishing a setting to live daemon state.
+function saveDaemonSetting(config, key, value, saveConfig) {
+  var overrides = {}; overrides[key] = value;
+  var next = Object.assign({}, config, overrides);
+  if (value === undefined) delete next[key];
+  saveConfig(next);
+  if (value === undefined) delete config[key];
+  Object.assign(config, next);
+  return next;
+}
+module.exports = { saveDaemonSetting: saveDaemonSetting };

package/lib/daemon.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+var saveDaemonSetting = require("./daemon-settings").saveDaemonSetting;
 
 // --- Node version check ---
 var nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
@@ -72,9 +73,7 @@ if (projectLogContext.initializeProjectKnowledge(config)) {
 }
 
 // --- OS users mode: check required system dependencies ---
-// Supplementary-group inheritance (issue #367): default on so sessions behave
-// like a normal login; operators can disable via config / the settings toggle.
-osUsersMod.setInheritGroups(config.inheritGroups !== false);
+// User-switched processes inherit the account groups, like a normal login.
 if (config.osUsers) {
   var checkExec = require("child_process").execFileSync;
   var missing = [];
@@ -86,11 +85,7 @@ if (config.osUsers) {
     console.error("[daemon] Install with:  sudo apt install " + missing.map(function (m) { return m.split(" ")[0]; }).join(" "));
     process.exit(78); // EX_CONFIG
   }
-  if (config.inheritGroups !== false) {
-    console.log("[daemon] Sessions inherit each user's supplementary groups (docker, etc.); disable in Settings > User Groups.");
-  } else {
-    console.log("[daemon] Sessions run with primary group only (supplementary groups dropped); enable in Settings > User Groups.");
-  }
+  console.log("[daemon] Sessions inherit each user's supplementary groups when setpriv is available.");
 }
 
 // --- TLS ---
@@ -637,12 +632,7 @@ var relay = createServer({
     return { envrc: config.sharedEnv || "" };
   },
   onSetSharedEnv: function (envrc) {
-    if (envrc) {
-      config.sharedEnv = envrc;
-    } else {
-      delete config.sharedEnv;
-    }
-    saveConfig(config);
+    saveDaemonSetting(config, "sharedEnv", envrc || undefined, saveConfig);
     return { ok: true };
   },
   onGetServerDefaultEffort: function () {
@@ -812,7 +802,6 @@ var relay = createServer({
       keepAwake: !!config.keepAwake,
       autoContinueOnRateLimit: !!config.autoContinueOnRateLimit,
       osUsers: !!config.osUsers,
-      inheritGroups: config.inheritGroups !== false,
       chatLayout: config.chatLayout || "channel",
       matesEnabled: config.matesEnabled === true,
       capsulesEnabled: config.capsulesEnabled === true,
@@ -827,25 +816,18 @@ var relay = createServer({
   onSetImageRetention: function (days) {
     var d = parseInt(days, 10);
     if (isNaN(d) || d < 0) d = 7;
-    config.imageRetentionDays = d;
-    saveConfig(config);
+    saveDaemonSetting(config, "imageRetentionDays", d, saveConfig);
     console.log("[daemon] Image retention:", d === 0 ? "forever" : d + " days");
     return { ok: true, days: d };
   },
   onSetUpdateChannel: function (channel) {
-    config.updateChannel = channel === "beta" ? "beta" : "stable";
-    saveConfig(config);
+    saveDaemonSetting(config, "updateChannel", channel === "beta" ? "beta" : "stable", saveConfig);
     console.log("[daemon] Update channel:", config.updateChannel, "(web)");
     return { ok: true, updateChannel: config.updateChannel };
   },
   onSetPin: function (pin) {
-    if (pin) {
-      config.pinHash = generateAuthToken(pin);
-    } else {
-      config.pinHash = null;
-    }
+    saveDaemonSetting(config, "pinHash", pin ? generateAuthToken(pin) : null, saveConfig);
     relay.setAuthToken(config.pinHash);
-    saveConfig(config);
     console.log("[daemon] PIN", pin ? "set" : "removed", "(web)");
     return { ok: true, pinEnabled: !!config.pinHash };
   },
@@ -921,8 +903,7 @@ var relay = createServer({
   },
   onSetKeepAwake: function (value) {
     var want = !!value;
-    config.keepAwake = want;
-    saveConfig(config);
+    saveDaemonSetting(config, "keepAwake", want, saveConfig);
     if (want && !caffeinateProc && process.platform === "darwin") {
       try {
         var { spawn: spawnCaff } = require("child_process");
@@ -936,16 +917,6 @@ var relay = createServer({
     console.log("[daemon] Keep awake:", want, "(web)");
     return { ok: true, keepAwake: want };
   },
-  onSetInheritGroups: function (value) {
-    var want = !!value;
-    config.inheritGroups = want;
-    saveConfig(config);
-    // Apply live so subsequent session/terminal spawns pick it up without a
-    // daemon restart; already-running sessions keep their current groups.
-    osUsersMod.setInheritGroups(want);
-    console.log("[daemon] Inherit supplementary groups:", want, "(web)");
-    return { ok: true, inheritGroups: want };
-  },
   onShutdown: function () {
     console.log("[daemon] Shutdown requested via web UI");
     gracefulShutdown();

package/lib/linear-store.js

@@ -19,34 +19,61 @@ function attachLinearStore(root) {
     catch (error) { if (error.code !== 'EEXIST') throw error; }
     return fs.readFileSync(file);
   }
-  function key(owner) {
+  function record(owner, id) {
     var data = read(owner);
+    return !id || id === "default" ? data : Object.hasOwn(data.connections || {}, id) ? data.connections[id] : {};
+  }
+  function key(owner, id) {
+    var data = record(owner, id);
     if (!data.secret) return null;
     var parts = data.secret.split('.').map(function (part) { return Buffer.from(part, 'base64'); });
     var cipher = crypto.createDecipheriv('aes-256-gcm', masterKey(), parts[0]);
-    cipher.setAAD(Buffer.from(owner)); cipher.setAuthTag(parts[1]);
+    cipher.setAAD(Buffer.from(id && id !== 'default' ? owner + ':' + id : owner)); cipher.setAuthTag(parts[1]);
     return Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8');
   }
-  function view(owner) {
-    var data = read(owner);
+  function view(owner, id) {
+    var data = record(owner, id);
     return { connected: !!data.secret, workspace: data.workspace || null, revision: data.revision || null };
   }
-  function save(owner, secret, workspace) {
+  function save(owner, secret, workspace, id, name) {
+    if (id && (!/^[a-zA-Z0-9_-]{1,64}$/.test(id) || ['__proto__', 'constructor', 'prototype'].indexOf(id) >= 0)) throw new Error("Invalid connection.");
+    var previous = read(owner);
     var file = filename(owner), data = { revision: crypto.randomBytes(16).toString('hex') };
     if (secret !== null) {
       if (typeof secret !== 'string' || !secret.trim() || secret.length > 4096 || /[\r\n]/.test(secret)) throw new Error('Enter a valid Linear API key.');
       var iv = crypto.randomBytes(12), cipher = crypto.createCipheriv('aes-256-gcm', masterKey(), iv);
-      cipher.setAAD(Buffer.from(owner));
+      cipher.setAAD(Buffer.from(id && id !== 'default' ? owner + ':' + id : owner));
       var bytes = Buffer.concat([cipher.update(secret.trim(), 'utf8'), cipher.final()]);
       data.secret = [iv, cipher.getAuthTag(), bytes].map(function (part) { return part.toString('base64'); }).join('.');
       data.workspace = workspace;
     }
+    if (name !== undefined) {
+      if (typeof name !== 'string' || !name.trim() || name.trim().length > 80) throw new Error('Enter a connection name of up to 80 characters.');
+      data.name = name.trim();
+    } else data.name = record(owner, id).name;
+    if (id && id !== 'default') {
+      previous.connections = previous.connections || {};
+      if (secret === null) delete previous.connections[id];
+      else {
+        if (!previous.connections[id] && Object.keys(previous.connections).length >= 30) throw new Error('Connection limit reached.');
+        previous.connections[id] = data;
+      }
+      data = previous;
+    } else data.connections = previous.connections;
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
     var temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
     try { fs.writeFileSync(temp, JSON.stringify(data), { mode: 0o600 }); fs.renameSync(temp, file); }
     finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
-    return view(owner);
+    return view(owner, id);
+  }
+  function list(owner) {
+    var data = read(owner), entries = [];
+    if (data.secret) entries.push(Object.assign({ id: 'default', name: data.name || 'Existing connection', legacy: true }, view(owner)));
+    Object.keys(data.connections || {}).forEach(function (id) {
+      entries.push(Object.assign({ id: id, name: data.connections[id].name || 'Linear', legacy: false }, view(owner, id)));
+    });
+    return entries;
   }
-  return { key: key, view: view, save: save };
+  return { key: key, view: view, save: save, list: list };
 }
 module.exports = { attachLinearStore: attachLinearStore };

package/lib/os-users.js

@@ -17,20 +17,11 @@ function isSafeLinuxUsername(username) {
 // --- Supplementary group inheritance (issue #367) ---
 // Node's child_process { uid, gid } options call setuid/setgid but never
 // initgroups(), so spawned sessions drop all supplementary groups (docker,
-// video, wheel, ...). When inheritGroups is enabled we route the spawn through
+// video, wheel, ...). Route user-switched spawns through
 // `setpriv --init-groups` so the child gets the same groups as a normal login.
-var _inheritGroups = true; // default: behave like a normal login shell
 var _setprivAvail = null;
 var _warnedNoSetpriv = false;
 
-function setInheritGroups(value) {
-  _inheritGroups = !!value;
-}
-
-function getInheritGroups() {
-  return _inheritGroups;
-}
-
 function setprivAvailable() {
   if (_setprivAvail !== null) return _setprivAvail;
   try {
@@ -50,7 +41,7 @@ function setprivAvailable() {
  * spawn()/execFileSync()/pty.spawn().
  *
  * - Same-user spawns (no uid/gid in options) are returned unchanged.
- * - When inheritGroups is disabled, or setpriv is unavailable, falls back to
+ * - When setpriv is unavailable, falls back to
  *   Node's uid/gid options (primary group only) so behavior degrades safely.
  * Requires the parent process to be root, which is the case in os-users mode.
  */
@@ -62,7 +53,7 @@ function wrapSpawnAsUser(command, args, options, setprivCheck) {
   if (uid == null || gid == null) return { command: command, args: args, options: options };
 
   var hasSetpriv = typeof setprivCheck === "function" ? setprivCheck() : setprivAvailable();
-  if (_inheritGroups && hasSetpriv) {
+  if (hasSetpriv) {
     var wrappedArgs = ["--reuid", String(uid), "--regid", String(gid), "--init-groups", "--", command].concat(args);
     var newOpts = Object.assign({}, options);
     delete newOpts.uid;
@@ -70,9 +61,9 @@ function wrapSpawnAsUser(command, args, options, setprivCheck) {
     return { command: "setpriv", args: wrappedArgs, options: newOpts };
   }
 
-  if (_inheritGroups && !_warnedNoSetpriv) {
+  if (!_warnedNoSetpriv) {
     _warnedNoSetpriv = true;
-    console.warn("[os-users] inheritGroups enabled but `setpriv` not found; supplementary groups will be dropped. Install util-linux to restore them.");
+    console.warn("[os-users] `setpriv` not found; supplementary groups will be dropped. Install util-linux to restore them.");
   }
   return { command: command, args: args, options: options };
 }
@@ -673,8 +664,6 @@ module.exports = {
   grantAllUsersAccess: grantAllUsersAccess,
   installClaudeCli: installClaudeCli,
   claudeAvailableForUser: claudeAvailableForUser,
-  setInheritGroups: setInheritGroups,
-  getInheritGroups: getInheritGroups,
   wrapSpawnAsUser: wrapSpawnAsUser,
   deactivateLinuxUser: deactivateLinuxUser,
   ensureProjectsDir: ensureProjectsDir,

package/lib/project-connection.js

@@ -246,13 +246,6 @@ function attachConnection(ctx) {
     sendTo(ws, { type: "email_accounts_list", accounts: emailAccountsList, providers: emailAccounts.PROVIDER_PRESETS });
     sendTo(ws, { type: "notes_list", notes: nm.list() });
     sendTo(ws, { type: "loop_registry_updated", records: getHubSchedules() });
-    // Initial per-user preference: how to render Claude sessions.
-    if (usersModule && typeof usersModule.getClaudeOpenMode === "function") {
-      var _comUid = (wsUser && wsUser.id) || null;
-      var _comVal = _comUid ? usersModule.getClaudeOpenMode(_comUid) : "gui";
-      sendTo(ws, { type: "claude_open_mode_changed", claudeOpenMode: _comVal || "gui" });
-    }
-
     _loop.sendConnectionState(ws);
     if (_mcp) _mcp.sendConnectionState(ws);
     if (_notifications) _notifications.sendConnectionState(ws, sendTo);

package/lib/project-filesystem.js

@@ -204,26 +204,28 @@ function attachFilesystem(ctx) {
 
     // --- Project settings permission gate ---
     if (msg.type === "get_project_env" || msg.type === "set_project_env" ||
-        msg.type === "read_global_claude_md" || msg.type === "write_global_claude_md" ||
         msg.type === "get_shared_env" || msg.type === "set_shared_env" ||
         msg.type === "transfer_project_owner") {
-      var globalSetting = /^(read_global_claude_md|write_global_claude_md|get_shared_env|set_shared_env)$/.test(msg.type);
+      var globalSetting = /^(get_shared_env|set_shared_env)$/.test(msg.type);
       var targetSlug = msg.slug || slug;
       if (!access.hasPermission(ws, "projectSettings") ||
           (globalSetting ? !access.isAdmin(ws) : !access.canAccessProject(ws, targetSlug))) {
-        sendTo(ws, { type: "error", text: "Project settings access is not permitted" });
+        sendTo(ws, { type: globalSetting ? (msg.type === 'get_shared_env' ? 'shared_env_result' : 'set_shared_env_result') : (msg.type === 'get_project_env' ? 'project_env_result' : msg.type === 'set_project_env' ? 'set_project_env_result' : 'error'), slug: targetSlug, requestId: msg.requestId, ok: false, error: 'Project settings access is not permitted', text: "Project settings access is not permitted" });
         return true;
       }
     }
 
     // --- Project environment variables ---
     if (msg.type === "get_project_env") {
+      if (typeof opts.onGetProjectEnv !== "function") { sendTo(ws, { type: "project_env_result", slug: targetSlug, requestId: msg.requestId, error: "Project environment is unavailable in this runtime." }); return true; }
       var envrc = "";
       if (typeof opts.onGetProjectEnv === "function") {
-        var envResult = opts.onGetProjectEnv(targetSlug);
+        var envResult;
+        try { envResult = opts.onGetProjectEnv(targetSlug); }
+        catch (error) { sendTo(ws, { type: "project_env_result", slug: targetSlug, requestId: msg.requestId, error: error.message }); return true; }
         envrc = envResult.envrc || "";
       }
-      sendTo(ws, { type: "project_env_result", slug: msg.slug, envrc: envrc });
+      sendTo(ws, { type: "project_env_result", slug: targetSlug, requestId: msg.requestId, envrc: envrc });
       return true;
     }
 
@@ -231,41 +233,16 @@ function attachFilesystem(ctx) {
       if (typeof opts.onSetProjectEnv === "function") {
         var envError = validateEnvString(msg.envrc || "");
         if (envError) {
-          sendTo(ws, { type: "set_project_env_result", ok: false, slug: msg.slug, error: envError });
+          sendTo(ws, { type: "set_project_env_result", ok: false, slug: targetSlug, requestId: msg.requestId, error: envError });
           return true;
         }
-        var setResult = opts.onSetProjectEnv(targetSlug, msg.envrc || "");
+        var setResult;
+        try { setResult = opts.onSetProjectEnv(targetSlug, msg.envrc || ""); }
+        catch (error) { sendTo(ws, { type: "set_project_env_result", slug: targetSlug, requestId: msg.requestId, ok: false, error: error.message }); return true; }
         if (setResult.ok) onEnvironmentChanged();
-        sendTo(ws, { type: "set_project_env_result", ok: setResult.ok, slug: msg.slug, error: setResult.error, timing: setResult.ok ? "Applies to newly created coding-agent processes. Active processes keep their current environment." : undefined });
+        sendTo(ws, { type: "set_project_env_result", ok: setResult.ok, slug: targetSlug, requestId: msg.requestId, error: setResult.error, timing: setResult.ok ? "Applies to newly created coding-agent processes. Active processes keep their current environment." : undefined });
       } else {
-        sendTo(ws, { type: "set_project_env_result", ok: false, error: "Not supported" });
-      }
-      return true;
-    }
-
-    // --- Global CLAUDE.md ---
-    if (msg.type === "read_global_claude_md") {
-      var globalMdPath = path.join(require("./config").REAL_HOME, ".claude", "CLAUDE.md");
-      try {
-        var globalMdContent = fs.readFileSync(globalMdPath, "utf8");
-        sendTo(ws, { type: "global_claude_md_result", content: globalMdContent });
-      } catch (e) {
-        sendTo(ws, { type: "global_claude_md_result", error: e.message });
-      }
-      return true;
-    }
-
-    if (msg.type === "write_global_claude_md") {
-      var globalMdDir = path.join(require("./config").REAL_HOME, ".claude");
-      var globalMdWritePath = path.join(globalMdDir, "CLAUDE.md");
-      try {
-        if (!fs.existsSync(globalMdDir)) {
-          fs.mkdirSync(globalMdDir, { recursive: true });
-        }
-        fs.writeFileSync(globalMdWritePath, msg.content || "", "utf8");
-        sendTo(ws, { type: "write_global_claude_md_result", ok: true });
-      } catch (e) {
-        sendTo(ws, { type: "write_global_claude_md_result", ok: false, error: e.message });
+        sendTo(ws, { type: "set_project_env_result", slug: targetSlug, requestId: msg.requestId, ok: false, error: "Not supported" });
       }
       return true;
     }
@@ -274,9 +251,12 @@ function attachFilesystem(ctx) {
     if (msg.type === "get_shared_env") {
       var sharedEnvrc = "";
       if (typeof opts.onGetSharedEnv === "function") {
-        var sharedResult = opts.onGetSharedEnv();
-        sharedEnvrc = sharedResult.envrc || "";
+        try {
+          var sharedResult = opts.onGetSharedEnv();
+          sharedEnvrc = sharedResult.envrc || "";
+        } catch (error) { sendTo(ws, { type: "shared_env_result", error: error.message }); return true; }
       }
+      if (typeof opts.onGetSharedEnv !== "function") { sendTo(ws, { type: "shared_env_result", error: "Shared environment is unavailable in this runtime." }); return true; }
       sendTo(ws, { type: "shared_env_result", envrc: sharedEnvrc });
       return true;
     }
@@ -288,7 +268,9 @@ function attachFilesystem(ctx) {
           sendTo(ws, { type: "set_shared_env_result", ok: false, error: sharedEnvError });
           return true;
         }
-        var sharedSetResult = opts.onSetSharedEnv(msg.envrc || "");
+        var sharedSetResult;
+        try { sharedSetResult = opts.onSetSharedEnv(msg.envrc || ""); }
+        catch (error) { sendTo(ws, { type: "set_shared_env_result", ok: false, error: error.message }); return true; }
         if (sharedSetResult.ok) onEnvironmentChanged();
         sendTo(ws, { type: "set_shared_env_result", ok: sharedSetResult.ok, error: sharedSetResult.error, timing: sharedSetResult.ok ? "Applies to newly created coding-agent processes. Active processes keep their current environment." : undefined });
       } else {

package/lib/project-mate-interaction.js

@@ -758,8 +758,8 @@ function attachMateInteraction(ctx) {
         onDone: mentionCallbacks.onDone,
         onError: mentionCallbacks.onError,
         canUseTool: function (toolName, input, toolOpts) {
-          // Full-auto mode: auto-approve everything except AskUserQuestion
-          if (sm.currentPermissionMode === "bypassPermissions" && toolName !== "AskUserQuestion") {
+          // Read the caller's live mode so reused mentions follow session changes.
+          if ((session.permissionMode || sm.currentPermissionMode) === "bypassPermissions" && toolName !== "AskUserQuestion") {
             return Promise.resolve({ behavior: "allow", updatedInput: input });
           }
           // Use the shared whitelist from sdk-bridge (read-only tools + safe bash commands)

package/lib/project-server-settings.js

@@ -0,0 +1,31 @@
+// Server administration messages. Every mutation returns an acknowledgement.
+var SETTINGS = {
+  set_pin: { callback: 'onSetPin', field: 'pin', valid: function (value) { return value === null || typeof value === 'string' && /^\d{6}$/.test(value); }, timing: 'Applies to new sign-ins.' },
+  set_keep_awake: { callback: 'onSetKeepAwake', field: 'value', timing: 'Applies while the daemon is running.' },
+  set_inherit_groups: { callback: 'onSetInheritGroups', field: 'value', timing: 'Applies to newly spawned agent and terminal processes.' },
+  set_image_retention: { callback: 'onSetImageRetention', field: 'days', valid: function (value) { return Number.isInteger(value) && value >= 0 && value <= 36500; }, timing: 'The next cleanup applies this period to existing images.' }
+};
+function handleServerSettings(ctx, ws, msg) {
+  var entry = SETTINGS[msg.type];
+  if (!entry) return false;
+  function reply(data) { ctx.sendTo(ws, Object.assign({ type: msg.type + '_result' }, data)); }
+  if (ctx.usersModule.isMultiUser()) {
+    var id = ws._clayUser && ws._clayUser.id;
+    var user = id && ctx.usersModule.findUserById(id);
+    if (!user || user.role !== 'admin') { reply({ ok: false, error: 'Administrator access required.' }); return true; }
+  }
+  var value = msg[entry.field];
+  if (entry.valid ? !entry.valid(value) : typeof value !== 'boolean') { reply({ ok: false, error: 'Invalid setting value.' }); return true; }
+  var opts = ctx.opts;
+  try {
+    var config = opts.onGetDaemonConfig ? opts.onGetDaemonConfig() : {};
+    if (msg.type === 'set_keep_awake' && config.platform !== 'darwin') throw new Error('Keep awake requires macOS.');
+    if (msg.type === 'set_inherit_groups') throw new Error('Group inheritance is automatic in OS-user mode and is no longer configurable.');
+    if (typeof opts[entry.callback] !== 'function') throw new Error('This runtime does not support saving this setting.');
+    var result = opts[entry.callback](value);
+    reply(Object.assign({}, result, { timing: entry.timing }));
+    if (result.ok && msg.type === 'set_keep_awake') ctx.send({ type: 'keep_awake_changed', keepAwake: result.keepAwake });
+  } catch (error) { reply({ ok: false, error: error.message || 'Could not save this setting.' }); }
+  return true;
+}
+module.exports = { handleServerSettings: handleServerSettings };