clay-server 5.1.1-beta.1 → 5.2.0-beta.1

package/lib/account-session-store.js

@@ -0,0 +1,82 @@
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+var DAY = 86400000;
+function digest(value) { return crypto.createHash('sha256').update(value).digest('hex'); }
+function attachSessionStore(ctx) {
+  var records = {};
+  function save(next) {
+    fs.mkdirSync(path.dirname(ctx.file), { recursive: true });
+    fs.writeFileSync(ctx.file + '.tmp', JSON.stringify({ version: 2, sessions: next }), { mode: 0o600 });
+    fs.renameSync(ctx.file + '.tmp', ctx.file);
+    records = next;
+  }
+  function metadata(userId, managed, req) {
+    var now = Date.now();
+    return { id: crypto.randomBytes(16).toString('hex'), userId: userId, createdAt: now, lastSeenAt: now,
+      expiresAt: managed ? now + 30 * DAY : null, idleMs: managed ? 7 * DAY : null,
+      userAgent: req && String(req.headers['user-agent'] || '').slice(0, 256) || '',
+      address: req ? ctx.clientAddress(req) : '', observedAt: req ? now : null };
+  }
+  try {
+    var data = JSON.parse(fs.readFileSync(ctx.file, 'utf8'));
+    if (data.version === 2 && data.sessions && typeof data.sessions === 'object') records = data.sessions;
+    else if (data && typeof data === 'object' && !Array.isArray(data)) {
+      var migrated = {};
+      Object.keys(data).forEach(function (token) {
+        var old = data[token]; var userId = typeof old === 'string' ? old : old && old.userId;
+        if (!userId) return;
+        var entry = metadata(userId, ctx.managed()); entry.migrated = true;
+        if (old.credential) entry.credentialVersion = digest(old.credential);
+        if (old.passkeyId) entry.passkeyId = old.passkeyId;
+        migrated[digest(token)] = entry;
+      });
+      save(migrated);
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw new Error('Could not load or migrate account sessions. Existing session data was not replaced.');
+  }
+  function live(entry) {
+    return !!entry && (!entry.expiresAt || Date.now() < entry.expiresAt) && (!entry.idleMs || Date.now() < entry.lastSeenAt + entry.idleMs);
+  }
+  function create(userId, credential, passkeyId, req, previousToken) {
+    var token = crypto.randomBytes(32).toString('hex');
+    var entry = metadata(userId, ctx.managed(), req);
+    if (credential) entry.credentialVersion = digest(credential);
+    if (passkeyId) entry.passkeyId = passkeyId;
+    var next = {};
+    var previousKey = previousToken ? digest(previousToken) : '';
+    Object.keys(records).forEach(function (key) {
+      if (live(records[key]) && !(key === previousKey && records[key].userId === userId)) next[key] = records[key];
+    });
+    next[digest(token)] = entry; save(next);
+    return { token: token, entry: entry };
+  }
+  function get(token, touch, req) {
+    if (typeof token !== 'string' || token.length > 256) return null;
+    var key = digest(token); var entry = records[key];
+    if (!live(entry)) return null;
+    if (touch && (!entry.observedAt || Date.now() - entry.lastSeenAt >= 60000)) {
+      var next = Object.assign({}, records); next[key] = Object.assign({}, entry, { lastSeenAt: Date.now() });
+      if (req) {
+        next[key].observedAt = Date.now();
+        next[key].userAgent = String(req.headers['user-agent'] || '').slice(0, 256);
+        next[key].address = ctx.clientAddress(req);
+      }
+      try { save(next); entry = next[key]; } catch (error) { /* Keep the earlier durable idle deadline on write failure. */ }
+    }
+    return entry;
+  }
+  function remove(test) {
+    var next = {}; var changed = false;
+    Object.keys(records).forEach(function (key) { if (test(records[key], key)) changed = true; else next[key] = records[key]; });
+    if (changed) save(next);
+  }
+  function list(userId) { return Object.values(records).filter(function (entry) { return entry.userId === userId && live(entry); }); }
+  return { create: create, get: get, list: list,
+    revokeUser: function (id) { remove(function (entry) { return entry.userId === id; }); },
+    revokeToken: function (token) { if (token) remove(function (entry, key) { return key === digest(token); }); },
+    revoke: function (userId, id, except) { remove(function (entry) { return entry.userId === userId && (id === 'others' ? entry.id !== except : entry.id === id); }); },
+  };
+}
+module.exports = { attachSessionStore: attachSessionStore, digest: digest };

package/lib/daemon.js

@@ -826,6 +826,7 @@ var relay = createServer({
     return { ok: true, updateChannel: config.updateChannel };
   },
   onSetPin: function (pin) {
+    if (usersModule.isMultiUser()) return { ok: false, error: 'Server PIN is unavailable while account authentication is enabled.' };
     saveDaemonSetting(config, "pinHash", pin ? generateAuthToken(pin) : null, saveConfig);
     relay.setAuthToken(config.pinHash);
     console.log("[daemon] PIN", pin ? "set" : "removed", "(web)");
@@ -1203,6 +1204,7 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       };
 
     case "set_pin": {
+      if (usersModule.isMultiUser()) return { ok: false, error: 'Server PIN is unavailable while account authentication is enabled.' };
       config.pinHash = msg.pinHash || null;
       relay.setAuthToken(config.pinHash);
       saveConfig(config);

package/lib/migrate-single-user.js

@@ -151,40 +151,20 @@ function migrateSingleUserToMulti() {
     backupFile(path.join(config.CONFIG_DIR, "users.json"), stamp);
     backupFile(path.join(config.CONFIG_DIR, "profile.json"), stamp);
 
-    // --- Flip to multi-user, then provision the sole admin ---
-    // Flip first so createUser's built-in mate seeding writes to the per-user
-    // mates path (CONFIG_DIR/mates/<userId>/), not the flat legacy path.
-    users.enableMultiUser();
-
+    // Persist the owner credential and account mode in the same atomic write.
     var displayName = (profile && profile.name) ? String(profile.name) : "Admin";
     var created = users.createUserWithoutPin({
       username: "admin",
       displayName: displayName,
       role: "admin",
       profile: profile || undefined,
-    });
+    }, { pinHash: cfg.pinHash || null });
     if (!created || !created.user) {
       console.error("[migrate] Failed to create admin user: " + (created && created.error));
-      // Roll the flag back so we don't leave a userless multi-user deploy.
-      try { users.disableMultiUser(); } catch (e) {}
       return { skipped: "create-failed" };
     }
     var userId = created.user.id;
 
-    // --- Carry over the PIN hash directly (preserve the existing credential;
-    // we have the hash, not the raw PIN, so we can't go through updateUserPin) ---
-    if (hasPin) {
-      try {
-        var data = users.loadUsers();
-        for (var i = 0; i < data.users.length; i++) {
-          if (data.users[i].id === userId) { data.users[i].pinHash = cfg.pinHash; break; }
-        }
-        users.saveUsers(data);
-      } catch (e) {
-        console.error("[migrate] PIN carry-over failed (user will have no PIN): " + (e.message || e));
-      }
-    }
-
     // --- Carry over settings ---
     try {
       if (cfg.chatLayout !== undefined && users.setChatLayout) users.setChatLayout(userId, cfg.chatLayout);
@@ -253,7 +233,7 @@ function ensureMultiUser() {
     // Try the legacy single-user migration first (handles PIN/settings/mates/
     // session carry-over for existing deploys).
     var mig = migrateSingleUserToMulti();
-    if (mig && mig.migrated) return mig;
+    if (mig && (mig.migrated || mig.skipped === "error" || mig.skipped === "create-failed")) return mig;
 
     // Fresh or empty deploy: provision a default admin so we're multi-user with
     // one user. No PIN -> the phase-1 solo auto-login skips the login wall.

package/lib/project-server-settings.js

@@ -13,6 +13,7 @@ function handleServerSettings(ctx, ws, msg) {
     var id = ws._clayUser && ws._clayUser.id;
     var user = id && ctx.usersModule.findUserById(id);
     if (!user || user.role !== 'admin') { reply({ ok: false, error: 'Administrator access required.' }); return true; }
+    if (msg.type === 'set_pin') { reply({ ok: false, error: 'Server PIN is unavailable while account authentication is enabled. Manage account credentials in Personal settings or Users.' }); return true; }
   }
   var value = msg[entry.field];
   if (entry.valid ? !entry.valid(value) : typeof value !== 'boolean') { reply({ ok: false, error: 'Invalid setting value.' }); return true; }

package/lib/project-user-knowledge.js

@@ -34,7 +34,7 @@ function attachProjectUserKnowledge(ctx) {
     } catch(error) {return '';}
   }
   function handleMessage(ws,msg) {
-    if(['you_attention','you_seen','you_list','you_read','you_activity','you_report','you_comment','you_retry'].indexOf(msg.type)===-1) return false;
+    if(['you_attention','you_seen','you_list','you_read','you_activity','you_report','you_comment','you_retry','you_delete'].indexOf(msg.type)===-1) return false;
     var reply={type:'you_result',operation:msg.type,requestId:msg.requestId,ok:false};
     try {
       var user=ws._clayUser;
@@ -44,6 +44,7 @@ function attachProjectUserKnowledge(ctx) {
       if(msg.type==='you_seen') reply.result=ctx.service.acknowledge(id,msg);
       if(msg.type==='you_list') reply.result=ctx.service.list(id,msg);
       if(msg.type==='you_read') reply.result=ctx.service.read(id,msg.ref);
+      if(msg.type==='you_delete') reply.result=ctx.service.remove(id,{ref:msg.ref,expectedRevision:msg.expectedRevision});
       if(msg.type==='you_activity') reply.result=ctx.service.activity(id,msg);
       if(msg.type==='you_comment') reply.result=ctx.service.comment(id,msg,{project:ctx.slug,session:'human',mateId:null});
       if(msg.type==='you_retry') { ctx.schedule(id); reply.result={pending:ctx.service.pendingCount(id)}; }

package/lib/public/auth/account-login.css

@@ -0,0 +1,98 @@
+@font-face {
+  font-family: Geist;
+  src: url('/auth/login-font.woff2') format('woff2');
+  font-weight: 100 900;
+  font-display: swap;
+}
+:root {
+  color-scheme: light dark;
+  --canvas: #f2f2ef;
+  --surface: #fafaf7;
+  --ink: #262720;
+  --muted: #696d61;
+  --edge: #dedfd5;
+  --field: #fff;
+  --accent: #5857fc;
+  --danger: #a12c2c;
+}
+* { box-sizing: border-box; }
+[hidden] { display: none !important; }
+body {
+  margin: 0;
+  min-height: 100svh;
+  padding: clamp(48px, 18svh, 160px) 20px 40px;
+  background: var(--canvas);
+  color: var(--ink);
+  font: 14px/1.5 Geist, system-ui, sans-serif;
+}
+main { width: 100%; max-width: 400px; margin: 0 auto; }
+.brand { text-align: center; margin: 0 0 32px; }
+.brand-lockup { display: flex; flex-direction: column; align-items: center; gap: clamp(.65rem, 1.2vw, .9rem); }
+.symbol { width: clamp(58px, 6vw, 82px); height: auto; object-fit: contain; filter: drop-shadow(0 12px 28px rgb(88 87 252 / .12)); }
+.wordmark { display: block; width: clamp(142px, 15vw, 184px); height: auto; filter: brightness(0); }
+.panel { padding: 26px; border: 1px solid var(--edge); border-radius: 14px; background: var(--surface); box-shadow: 0 3px 12px #00000003; }
+[data-stage="welcome"] .panel { width: calc(100% - 54px); margin: 0 auto; padding: 0; border: 0; border-radius: 0; background: transparent; box-shadow: none; }
+.panel-header { display: flex; align-items: center; gap: 10px; margin-bottom: 10px; }
+h1 { font-size: 19px; font-weight: 550; letter-spacing: -.35px; line-height: 1.3; margin: 0; overflow-wrap: anywhere; }
+[data-stage="welcome"] .panel-header, [data-stage="welcome"] #description { display: none; }
+#description { font-size: 13px; color: var(--muted); margin: 0 0 22px; }
+button, input { font: inherit; }
+button { cursor: pointer; min-height: 36px; border: 1px solid var(--edge); border-radius: 8px; background: var(--surface); color: var(--ink); padding: 7px 12px; font-size: 13px; font-weight: 500; transition: background-color 120ms, border-color 120ms, transform 100ms; }
+button:disabled { cursor: wait; opacity: .6; }
+button:hover:not(:disabled) { filter: brightness(.96); }
+button:active:not(:disabled) { transform: translateY(1px); }
+button:focus-visible, input:focus-visible, summary:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; }
+.primary { display: block; width: 100%; background: var(--accent); border-color: var(--accent); color: #fff; margin-top: 18px; }
+.method { min-height: 42px; margin-top: 10px; }
+#welcome > .method:first-of-type { margin-top: 0; }
+#accounts:not(:empty) { margin-bottom: 12px; }
+.secondary { background: transparent; border-color: var(--edge); color: var(--ink); }
+.quiet { background: transparent; border: 0; color: var(--muted); font-size: 12px; display: block; margin: 10px auto 0; padding: 6px 4px; }
+.back { display: grid; place-items: center; flex-shrink: 0; width: 28px; min-height: 28px; padding: 0; margin-left: -5px; border: 0; background: transparent; color: var(--muted); }
+label { display: block; font-size: 12px; font-weight: 500; margin: 16px 0 6px; }
+form > label:first-child { margin-top: 0; }
+input { width: 100%; height: 40px; border: 1px solid var(--edge); border-radius: 8px; background: var(--field); color: var(--ink); padding: 8px 11px; font-size: 14px; }
+.secret-field { position: relative; }
+.secret-field input { padding-right: 60px; }
+.secret-field button { position: absolute; right: 4px; top: 3px; min-height: 34px; border: 0; background: transparent; padding: 5px 8px; font-size: 12px; color: var(--muted); }
+.account-row { display: flex; border: 1px solid var(--edge); border-radius: 10px; margin-bottom: 8px; background: var(--field); }
+.account-choice { flex: 1; min-width: 0; display: flex; align-items: center; gap: 12px; text-align: left; border: 0; background: transparent; padding: 12px; border-radius: 10px 0 0 10px; }
+.account-copy, .identity-chip > div { min-width: 0; }
+.account-copy strong, .identity-chip strong { display: block; font-size: 13px; font-weight: 550; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.account-copy small, .identity-chip small { display: block; font-size: 12px; color: var(--muted); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.forget { border: 0; background: transparent; font-size: 12px; color: var(--muted); padding: 8px 12px; border-radius: 0 10px 10px 0; }
+.avatar { width: 34px; height: 34px; flex-shrink: 0; display: grid; place-items: center; border-radius: 9px; border: 1px solid var(--edge); background: var(--canvas); font-size: 12px; font-weight: 550; }
+.identity-chip { display: flex; align-items: center; gap: 10px; margin: 0 0 20px; }
+#status, #error { font-size: 12px; margin: 14px 0 0; }
+#status:empty, #error:empty { display: none; }
+#status { color: var(--muted); }
+#error { color: var(--danger); }
+footer { display: flex; flex-direction: column; align-items: center; gap: 8px; margin: 22px 0 0; color: var(--muted); font-size: 12px; text-align: center; }
+footer details { max-width: 320px; }
+footer summary { cursor: pointer; padding: 3px 6px; }
+footer p { line-height: 1.6; margin: 8px 0; }
+#server-address { overflow-wrap: anywhere; font-size: 11px; }
+.offscreen { position: absolute; width: 1px; height: 1px; clip-path: inset(50%); overflow: hidden; }
+.view:not([hidden]) { animation: arrive 140ms ease-out; }
+@keyframes arrive { from { transform: translateY(3px); } to { transform: translateY(0); } }
+@media (prefers-color-scheme: dark) {
+  :root { --canvas: #181a17; --surface: #20231e; --ink: #eeeee7; --muted: #a6ab9d; --edge: #393e34; --field: #181b17; --danger: #ffaaaa; }
+  .wordmark { filter: brightness(0) invert(1); }
+}
+@media (max-width: 440px) {
+  body { padding: 64px 16px 28px; }
+  .brand { margin-bottom: 28px; }
+  .panel { padding: 22px; }
+  [data-stage="welcome"] .panel { width: calc(100% - 46px); }
+  input { font-size: 16px; }
+}
+@media (max-height: 600px) { body { padding-top: 24px; } }
+@media (pointer: coarse) {
+  .primary { min-height: 42px; }
+  .back { width: 36px; min-height: 36px; }
+  .quiet { min-height: 40px; }
+}
+@media (prefers-reduced-motion: reduce) {
+  .view:not([hidden]) { animation: none; }
+  button { transition: none; }
+}

package/lib/public/auth/account-login.js

@@ -0,0 +1,104 @@
+import { supported, getPasskey, passkeyError, request } from '/auth/passkey-browser.js';
+var root = document.getElementById('login');
+var password = root.dataset.password === 'true';
+var selected = null;
+var pin = !password;
+var busy = false;
+var stage = 'welcome';
+var accounts = [];
+var credentialBack = 'welcome';
+function el(id) { return document.getElementById(id); }
+function initials(name) {
+  var words = (name || '?').trim().split(/\s+/);
+  return (Array.from(words[0])[0] + (words.length > 1 ? Array.from(words[words.length - 1])[0] : '')).toUpperCase();
+}
+function show(next, moveFocus) {
+  stage = next;
+  root.dataset.stage = next;
+  document.querySelectorAll('.view').forEach(function (view) { view.hidden = view.id !== next; });
+  el('error').textContent = ''; el('status').textContent = ''; el('back').hidden = next === 'welcome';
+  el('secret').value = ''; el('secret').type = 'password'; el('reveal').textContent = 'Show'; el('reveal').setAttribute('aria-pressed', 'false');
+  var copy = {
+    welcome: ['Sign in', 'Choose how to sign in.'],
+    identity: ['Sign in', 'Enter your username to continue.'],
+    credential: ['Sign in', pin ? 'Enter your account PIN to continue.' : 'Enter your password to continue.'],
+    enroll: ['Set your password.', 'Your administrator has enabled passwords. Use 15–128 characters. Your account PIN is replaced only after saving.'],
+    email: ['Sign in with email', 'We’ll send a sign-in code to your account’s email address.'],
+    code: ['Check your inbox.', 'Enter the six-digit code we sent you.'],
+  };
+  el('heading').textContent = copy[next][0]; el('description').textContent = copy[next][1];
+  if (next === 'credential') {
+    el('selected-name').textContent = selected.name; el('selected-username').textContent = selected.username;
+    el('selected-username').hidden = selected.name.toLowerCase() === selected.username.toLowerCase();
+    el('selected-avatar').textContent = initials(selected.name); el('credential-username').value = selected.username;
+    el('secret-label').textContent = pin ? 'Account PIN' : 'Password';
+    el('secret').inputMode = pin ? 'numeric' : 'text'; el('secret').maxLength = pin ? 6 : 256;
+    if (pin) el('secret').setAttribute('pattern', '[0-9]{6}'); else el('secret').removeAttribute('pattern');
+    el('use-pin').hidden = !password; el('use-pin').textContent = pin ? 'Use my password' : 'I still use an account PIN';
+  }
+  var focus = { identity: 'username', credential: 'secret', enroll: 'new-password', email: 'email-address', code: 'otp' };
+  if (moveFocus !== false) {
+    if (focus[next]) el(focus[next]).focus({ preventScroll: true });
+    else el('account').focus({ preventScroll: true });
+  }
+}
+function renderAccounts() {
+  el('accounts').replaceChildren();
+  accounts.forEach(function (account) {
+    var row = document.createElement('div'); row.className = 'account-row';
+    var button = document.createElement('button'); button.className = 'account-choice';
+    var avatar = document.createElement('span'); avatar.className = 'avatar'; avatar.textContent = initials(account.name);
+    var copy = document.createElement('span'); copy.className = 'account-copy';
+    var name = document.createElement('strong'); name.textContent = account.name;
+    var username = document.createElement('small'); username.textContent = account.username;
+    username.hidden = account.name.toLowerCase() === account.username.toLowerCase();
+    copy.append(name, username); button.append(avatar, copy);
+    button.onclick = function () { selected = account; credentialBack = 'welcome'; pin = !password; show('credential'); };
+    var forget = document.createElement('button'); forget.className = 'forget'; forget.textContent = 'Forget';
+    forget.setAttribute('aria-label', 'Forget ' + account.name + ' on this browser');
+    forget.onclick = function () { run(async function () { var result = await request('/auth/accounts', { forget: account.id }); accounts = result.accounts; renderAccounts(); show('welcome'); }); };
+    row.append(button, forget); el('accounts').append(row);
+  });
+  el('account').textContent = accounts.length ? 'Use another account' : 'Sign in with an account';
+  el('account').classList.toggle('secondary', accounts.length > 0 || !el('passkey').hidden);
+}
+async function run(action) {
+  if (busy) return;
+  busy = true; el('error').textContent = ''; el('status').textContent = 'Just a moment…';
+  document.querySelectorAll('button').forEach(function (button) { button.disabled = true; });
+  try { await action(); } catch (error) { el('error').textContent = passkeyError(error); }
+  finally { busy = false; el('status').textContent = ''; document.querySelectorAll('button').forEach(function (button) { button.disabled = false; }); }
+}
+function enter() { location.assign('/'); }
+el('server-address').textContent = location.host;
+el('account').onclick = function () { show('identity'); };
+el('back').onclick = function () { el('new-password').value = ''; el('confirm-password').value = ''; el('otp').value = ''; show(stage === 'code' ? 'email' : stage === 'credential' ? credentialBack : 'welcome'); };
+el('identity').onsubmit = function (event) { event.preventDefault(); var username = el('username').value.trim(); if (!username) return; selected = { username: username, name: username }; credentialBack = 'identity'; pin = !password; show('credential'); };
+el('use-pin').onclick = function () { pin = !pin; show('credential'); };
+el('reveal').onclick = function () { var visible = el('secret').type === 'password'; el('secret').type = visible ? 'text' : 'password'; el('reveal').textContent = visible ? 'Hide' : 'Show'; el('reveal').setAttribute('aria-pressed', String(visible)); };
+el('credential').onsubmit = function (event) {
+  event.preventDefault(); run(async function () {
+    var data = { username: selected.username }; data[pin ? 'pin' : 'password'] = el('secret').value;
+    var result = await request('/auth/login', data); if (result.passwordRequired) show('enroll'); else enter();
+  });
+};
+el('enroll').onsubmit = function (event) {
+  event.preventDefault(); run(async function () {
+    var value = el('new-password').value; var confirmation = el('confirm-password').value;
+    if (value !== confirmation) throw new Error('Passwords do not match.');
+    await request('/auth/password-transition', { password: value, confirmPassword: confirmation }); enter();
+  });
+};
+async function sendCode() { await request('/auth/request-otp', { email: el('email-address').value.trim() }); el('otp').value = ''; show('code'); }
+el('email-method').hidden = root.dataset.email !== 'true';
+el('email-method').onclick = function () { show('email'); };
+el('email').onsubmit = function (event) { event.preventDefault(); run(sendCode); };
+el('resend').onclick = function () { run(sendCode); };
+el('code').onsubmit = function (event) { event.preventDefault(); run(async function () { await request('/auth/verify-otp', { email: el('email-address').value.trim(), code: el('otp').value }); enter(); }); };
+el('passkey').onclick = function () { run(async function () { var options = await request('/auth/passkeys/login/options', {}); var response = await getPasskey(options.options); await request('/auth/passkeys/login/verify', { response: response }); enter(); }); };
+async function initialize() {
+  try { var result = await request('/auth/accounts'); accounts = result.accounts; renderAccounts(); if (stage === 'welcome') show('welcome', false); } catch (error) { /* Account sign-in remains available without remembered names. */ }
+  if (!password || !supported()) return;
+  try { var status = await request('/auth/passkeys/status'); if (status.origin === location.origin) { el('passkey').hidden = false; renderAccounts(); } } catch (error) { /* Password sign-in remains available without passkeys. */ }
+}
+initialize();

package/lib/public/css/user-settings-sessions.css

@@ -0,0 +1,42 @@
+/* A contained collection within Account settings, distinct from setting rows. */
+#user-settings #us-sessions-panel {
+  margin: 8px 0 16px;
+  padding: 12px 14px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: rgba(var(--overlay-rgb), 0.025);
+}
+#user-settings #us-sessions-panel > .settings-hint { margin: 0 0 8px; }
+#user-settings #us-sessions-panel .settings-field-row {
+  padding: 12px 0;
+  gap: 12px;
+}
+#user-settings #us-sessions-panel .settings-field-row > div {
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+#user-settings #us-sessions-panel [role="list"] > .settings-field-row:last-child { border-bottom: 0; }
+#user-settings #us-sessions-panel [data-earlier] {
+  margin-top: 4px;
+  padding-top: 10px;
+  border-top: 1px solid var(--border-subtle);
+}
+#user-settings #us-sessions-panel summary {
+  display: list-item;
+  cursor: pointer;
+  padding: 2px 0;
+  list-style: disclosure-closed inside;
+}
+#user-settings #us-sessions-panel details[open] > summary { list-style-type: disclosure-open; }
+#user-settings #us-sessions-panel summary:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; }
+#user-settings #us-sessions-panel [data-confirmation] {
+  margin-top: 12px;
+  padding-top: 10px;
+  border-top: 1px solid var(--border-subtle);
+}
+#user-settings #us-sessions-panel .us-session-row-confirm { flex: 0 0 190px; }
+#user-settings #us-sessions-panel .us-session-row-confirm .settings-form-actions { margin-top: 6px; gap: 6px; }
+#user-settings #us-sessions-panel .us-session-row-confirm .settings-hint { margin: 0; }
+@media (max-width: 640px) {
+  #user-settings #us-sessions-panel .us-session-row-confirm { flex: none; width: 100%; }
+}

package/lib/public/index.html

@@ -821,6 +821,7 @@
         <!-- Account section -->
         <div class="us-section" data-section="us-account">
           <h2>Account</h2>
+          <p class="settings-page-description">Your profile, sign-in credentials and signed-in devices on this server.</p>
           <div class="settings-card">
             <div class="us-account-hero">
               <div class="us-account-avatar" aria-hidden="true">
@@ -834,15 +835,24 @@
               </div>
             </div>
           </div>
-          <h3>Security</h3>
+          <h3>Sign-in &amp; security</h3>
+          <p class="settings-hint">Manage your own account here. Server-wide sign-in requirements are set by the administrator.</p>
           <div class="settings-card">
             <div class="settings-field-row">
               <div>
-                <label class="settings-label">PIN</label>
-                <div class="settings-hint">Protect the web UI with a 6-digit PIN.</div>
+                <label class="settings-label">Account PIN</label>
+                <div class="settings-hint">Manage the PIN used to sign in to your account.</div>
               </div>
               <button class="settings-btn-sm" id="us-pin-set-btn">Set PIN</button>
             </div>
+            <div class="settings-field-row" id="us-passkey-row" hidden>
+              <div><span class="settings-label">Passkeys</span><p class="settings-hint">Add, rename or remove your account's passkeys.</p></div>
+              <a class="settings-btn-sm" href="/account/passkeys">Manage passkeys</a>
+            </div>
+            <div class="settings-field-row" id="us-sessions-row" hidden>
+              <div><span class="settings-label">Signed-in devices</span><p class="settings-hint">Review your browser sessions and sign out this or other devices.</p></div>
+              <button type="button" class="settings-btn-sm" id="us-sessions-toggle" aria-expanded="false" aria-controls="us-sessions-panel">Manage sessions</button>
+            </div>
             <div class="settings-field hidden" id="us-pin-form">
               <div class="settings-pin-form-title" id="us-pin-form-title">Change PIN</div>
               <div class="settings-pin-current-row" id="us-pin-current-row">
@@ -1139,7 +1149,8 @@
           </div>
         </div>
 <div class="server-settings-section" data-section="security">
-          <h2 tabindex="-1">Access &amp; security</h2><p class="settings-page-description">Server sign-in policy. Individual account PINs are managed in Personal settings.</p><h3>Server PIN</h3>
+          <h2 tabindex="-1">Access &amp; security</h2><p class="settings-page-description">Sign-in policies and connection security for this server. Manage your own password, passkeys and devices in Personal settings → Account.</p>
+          <section id="settings-server-pin" hidden><h3>Server PIN</h3>
           <div class="settings-card">
             <div class="settings-field-row">
               <div>
@@ -1168,9 +1179,10 @@
               <div class="settings-hint settings-pin-error hidden" id="settings-pin-error">PIN must be exactly 6 digits.</div>
             </div>
           </div>
+          </section>
         </div>
 <div class="server-settings-section settings-admin-only" data-section="admin-users">
-          <h2 tabindex="-1">Users</h2><p class="settings-page-description">Manage server accounts, permissions and invitations. Changes apply to the selected user.</p>
+          <h2 tabindex="-1">Users</h2><p class="settings-page-description">Manage server accounts, permissions, account recovery and invitations. Changes apply to the selected user.</p>
           <h3>Accounts</h3><div class="settings-card" id="admin-users-body"></div>
           <section class="settings-section-divider"><h3>Invitations</h3><p class="settings-hint">Create, copy, email or revoke invitation links. Email invitations require server SMTP.</p>
           <div class="settings-card" id="admin-invites-body"></div></section>

package/lib/public/modules/account-auth-settings.js

@@ -0,0 +1,71 @@
+import { store } from './store.js';
+import { enhanceSettingsSelects } from './settings-select.js';
+import { confirmSettingsAction, setSettingsDraft, clearSettingsDraft } from './server-settings-state.js';
+import { initPasskeyServerSettings, loadPasskeyServerSettings } from './passkey-server-settings.js';
+import { initAccountTransportSettings, loadAccountTransportSettings } from './account-transport-settings.js';
+
+function render(state) {
+  var section = document.getElementById('account-auth-policy');
+  if (!section) return;
+  var select = section.querySelector('select');
+  var save = section.querySelector('[data-policy-save]');
+  section.hidden = state.available === false;
+  select.value = state.draft || state.method || 'pin';
+  select.disabled = !!state.pending || state.method === 'password' || !state.method;
+  select.dispatchEvent(new Event('settings-sync'));
+  save.hidden = !state.method || state.method === select.value;
+  save.disabled = !!state.pending;
+  section.querySelector('[role=status]').textContent = state.error || (state.pending ? 'Saving…' : state.method === 'password' ? 'Password required. Existing account PINs only authorize password setup.' : 'Existing users verify their account PIN once, then set a password before continuing.');
+}
+
+export async function loadAccountAuthSettings() {
+  loadPasskeyServerSettings();
+  var section = document.getElementById('account-auth-policy');
+  if (!section) return;
+  if ((store.get('accountAuthPolicy') || {}).draft) return;
+  try {
+    var response = await fetch('/api/account-auth-policy');
+    var data = await response.json();
+    if (!response.ok) throw new Error(data.error || 'Could not load account policy.');
+    store.set({ accountAuthPolicy: data }); render(data); loadAccountTransportSettings();
+  } catch (error) {
+    var state = Object.assign({}, store.get('accountAuthPolicy'), { error: error.message });
+    store.set({ accountAuthPolicy: state }); render(state);
+  }
+}
+
+export function initAccountAuthSettings() {
+  var page = document.querySelector('.server-settings-section[data-section="security"]');
+  if (!page || document.getElementById('account-auth-policy')) return;
+  var section = document.createElement('section'); section.id = 'account-auth-policy';
+  section.className = 'settings-card';
+  section.innerHTML = '<h3>Account sign-in</h3><div class="settings-field-row"><div><label class="settings-label" for="account-auth-method">Authentication method</label><p class="settings-hint">Applies to all accounts on this server. Users manage their own credentials in Personal settings.</p></div><select class="settings-select" id="account-auth-method" disabled><option value="pin">Account PIN</option><option value="password">Password / passphrase</option></select></div><p class="settings-hint" role="status">Loading account policy…</p><div class="settings-form-actions"><button class="settings-btn-sm" data-policy-save hidden>Apply password policy</button></div>';
+  var description = page.querySelector('.settings-page-description');
+  description.textContent = 'Sign-in policies and connection security for this server. Manage your own password, passkeys and devices in Personal settings → Account.';
+  description.after(section);
+  var select = section.querySelector('select');
+  select.onchange = function () {
+    var state = Object.assign({}, store.get('accountAuthPolicy'), { draft: select.value, error: '' });
+    if (state.draft === state.method) { delete state.draft; clearSettingsDraft('accountAuth'); }
+    else setSettingsDraft('accountAuth', true);
+    store.set({ accountAuthPolicy: state }); render(state);
+  };
+  section.querySelector('[data-policy-save]').onclick = function () {
+    confirmSettingsAction('Require passwords for account users? Everyone using an account, including you, must verify their account PIN and set a password before continuing. Existing PINs remain valid for setup until each password is saved. This change does not alter solo access or the Server PIN.', 'Require passwords', async function () {
+      var state = Object.assign({}, store.get('accountAuthPolicy'), { pending: true, error: '' });
+      store.set({ accountAuthPolicy: state }); render(state);
+      try {
+        var response = await fetch('/api/account-auth-policy', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ method: 'password' }) });
+        var data = await response.json();
+        if (!response.ok || !data.ok) throw new Error(data.error || 'Could not save the policy.');
+        clearSettingsDraft('accountAuth'); window.location.reload();
+      } catch (error) {
+        state.pending = false; state.error = error.message;
+        store.set({ accountAuthPolicy: state }); render(state);
+      }
+    });
+  };
+  enhanceSettingsSelects(section);
+  initPasskeyServerSettings();
+  initAccountTransportSettings();
+}

package/lib/public/modules/account-transport-settings.js

@@ -0,0 +1,51 @@
+import { store } from './store.js';
+import { setSettingsDraft, clearSettingsDraft } from './server-settings-state.js';
+function render(state) {
+  var section = document.getElementById('account-transport'); if (!section) return;
+  section.hidden = !state.available;
+  if (!state.dirty) {
+    section.querySelector('[name=origin]').value = state.origin || '';
+    section.querySelector('[name=proxies]').value = (state.trustedProxies || []).join('\n');
+  }
+  section.querySelectorAll('input,textarea,button').forEach(function (element) { element.disabled = !!state.pending; });
+  section.querySelector('[role=status]').textContent = state.error || (state.pending ? 'Saving…' : state.origin ? 'Saved proxy HTTPS address: ' + state.origin : 'Direct HTTPS or localhost access. No proxy headers are trusted.');
+}
+export async function loadAccountTransportSettings() {
+  if ((store.get('accountTransport') || {}).dirty) return;
+  try {
+    var response = await fetch('/api/account-transport'); var data = await response.json();
+    if (!response.ok) throw new Error(data.error || 'Could not load connection settings.');
+    var state = Object.assign({}, data, { available: (store.get('accountAuthPolicy') || {}).method === 'password' });
+    store.set({ accountTransport: state }); render(state);
+  } catch (error) {
+    var state = Object.assign({}, store.get('accountTransport'), { error: error.message });
+    store.set({ accountTransport: state }); render(state);
+  }
+}
+export function initAccountTransportSettings() {
+  var anchor = document.getElementById('passkey-policy'); if (!anchor || document.getElementById('account-transport')) return;
+  var section = document.createElement('section'); section.id = 'account-transport'; section.className = 'settings-card'; section.hidden = true;
+  section.innerHTML = '<h3>HTTPS &amp; trusted proxies</h3><p class="settings-hint">Connection security for account users on this server. Account passwords require HTTPS for remote access. Localhost is available for setup and recovery.</p>' +
+    '<form><label class="settings-label" for="account-external-origin">Proxy HTTPS address</label><input class="us-text-input" id="account-external-origin" name="origin" type="url" placeholder="https://clay.example.com">' +
+    '<label class="settings-label" for="account-trusted-proxies">Trusted proxy IP addresses</label><textarea class="settings-network-origins" id="account-trusted-proxies" name="proxies" rows="2" placeholder="One exact IP address per line"></textarea>' +
+    '<p class="settings-hint">Leave empty for direct HTTPS. Each trusted proxy must overwrite X-Forwarded-Proto and X-Real-IP, prevent direct public access to the backend, and serve this HTTPS address. Forwarded host headers are ignored.</p>' +
+    '<label class="settings-label" for="account-transport-password">Administrator password</label><input class="us-text-input" id="account-transport-password" name="password" type="password" autocomplete="current-password" required>' +
+    '<div class="settings-form-actions"><button class="settings-btn-sm">Save connection settings</button></div></form><p class="settings-hint" role="status"></p>';
+  anchor.after(section);
+  section.querySelectorAll('[name=origin],[name=proxies]').forEach(function (input) { input.oninput = function () {
+    var state = Object.assign({}, store.get('accountTransport'), { dirty: true, error: '' });
+    setSettingsDraft('accountTransport', true); store.set({ accountTransport: state }); render(state);
+  }; });
+  section.querySelector('form').onsubmit = async function (event) {
+    event.preventDefault(); var password = section.querySelector('[name=password]');
+    var state = Object.assign({}, store.get('accountTransport'), { pending: true, error: '' }); store.set({ accountTransport: state }); render(state);
+    try {
+      var response = await fetch('/api/account-transport', { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({
+        origin: section.querySelector('[name=origin]').value.trim(), trustedProxies: section.querySelector('[name=proxies]').value.split(/\s+/).filter(Boolean), currentPassword: password.value,
+      }) });
+      var data = await response.json(); if (!response.ok) throw new Error(data.error || 'Could not save connection settings.');
+      state = Object.assign({}, data, { available: true }); clearSettingsDraft('accountTransport');
+    } catch (error) { state.error = error.message; state.pending = false; }
+    finally { password.value = ''; store.set({ accountTransport: state }); render(state); }
+  };
+}

package/lib/public/modules/app-messages.js

@@ -1483,6 +1483,10 @@ export function processMessage(msg) {
         addContextOverflowMessage(msg);
         break;
 
+      case "account_auth_required":
+        window.location.reload();
+        break;
+
       case "auth_required":
         removeMatePreThinking();
         setActivity(null);