clay-server 5.1.1-beta.1 → 5.2.0-beta.2

package/lib/user-knowledge-service.js

@@ -22,6 +22,7 @@ function attachUserKnowledgeService(deps) {
       if (record.seen) result.seen[record.seen.ref] = Math.max(result.seen[record.seen.ref] || 0, record.seen.revision);
       if (record.entry) result.entries[record.entry.ref] = record.entry;
       if (record.report) result.reports[record.report.ref] = record.report;
+      (Array.isArray(record.reports) ? record.reports : []).forEach(function (report) { result.reports[report.ref] = report; });
       if (record.activity) result.activity.push(record.activity);
     });
     return result;
@@ -73,6 +74,26 @@ function attachUserKnowledgeService(deps) {
     });
     return Object.assign({}, entry, { comments: comments, commentCount: comments.length });
   }
+  function remove(id,args) {
+    var state = snapshot(id);
+    var previous = state.entries[args.ref];
+    if (!previous || previous.archived || previous.deleted) throw new Error('User knowledge not found.');
+    if (!Number.isInteger(args.expectedRevision) || args.expectedRevision !== previous.revisions) throw new Error('Knowledge changed. Read it again before deleting.');
+    var now = Date.now();
+    var entry = Object.assign({}, previous, { archived: true, deleted: true, deletedAt: now, updatedAt: now,
+      revisions: previous.revisions + 1, updatedBy: { type: 'user', displayName: 'You' }, reason: 'Deleted by the account owner.' });
+    var reports = Object.values(state.reports).filter(function (report) {
+      return report.status === 'pending' && (report.entryRef === previous.ref || report.commentEntryRef === previous.ref);
+    });
+    var reportUpdates = reports.map(function (report) { return Object.assign({}, report, {
+      status: 'declined', reviewedAt: now, reason: 'The knowledge entry was deleted by the account owner.'
+    }); });
+    var activity = { id: crypto.randomBytes(12).toString('hex'), ref: previous.ref, title: previous.title,
+      summary: previous.summary, at: now, action: 'delete', revision: entry.revisions, deleted: true };
+    storage(id).append({ kind: 'user-knowledge', entry: entry, reports: reportUpdates, activity: activity });
+    try { deps.onChange(owner(id), activity); } catch (error) { /* The deletion survives notification failures. */ }
+    return { entry: entry, activity: activity };
+  }
   function comment(id,args,source) {
     var entry = read(id,args.ref);
     return report(id,{observation:args.body,evidence:'Comment on '+entry.ref+': '+args.body,evidenceType:'explicit'},source,entry.ref);
@@ -141,6 +162,7 @@ function attachUserKnowledgeService(deps) {
         var reason=text(args.reason,2000,true);
         var previous=args.ref ? state.entries[args.ref]:null;
         if (args.ref && !previous) throw new Error('User knowledge not found.');
+        if (previous && (previous.archived || previous.deleted)) throw new Error('User knowledge not found.');
         if (previous && args.expectedRevision!==previous.revisions) throw new Error('Knowledge changed. Read it again before updating.');
         var entry=null;
         var now=Date.now();
@@ -162,6 +184,6 @@ function attachUserKnowledgeService(deps) {
       }
     };
   }
-  return {bind:bind,list:list,read:read,report:report,comment:comment,attention:attention,acknowledge:acknowledge,activity:function(id,args){return page(snapshot(id).activity.slice().reverse(),args);},pendingCount:function(id){return Object.values(snapshot(id).reports).filter(function(r){return r.status==='pending';}).length;}};
+  return {bind:bind,list:list,read:read,remove:remove,report:report,comment:comment,attention:attention,acknowledge:acknowledge,activity:function(id,args){return page(snapshot(id).activity.slice().reverse(),args);},pendingCount:function(id){return Object.values(snapshot(id).reports).filter(function(r){return r.status==='pending';}).length;}};
 }
 module.exports={attachUserKnowledgeService:attachUserKnowledgeService};

package/lib/users-auth.js

@@ -1,4 +1,5 @@
 var crypto = require("crypto");
+var serverPin = require('./users-server-pin');
 
 function attachAuth(deps) {
   var loadUsers = deps.loadUsers;
@@ -80,7 +81,29 @@ function attachAuth(deps) {
   // --- Pin hashing ---
 
   function hashPin(pin) {
-    return crypto.createHash("sha256").update("clay-user:" + pin).digest("hex");
+    var salt = crypto.randomBytes(16).toString("hex");
+    var hash = crypto.scryptSync("clay-user:" + pin, salt, 64, { N: 16384, r: 8, p: 1 }).toString("hex");
+    return "scrypt-v1:" + salt + ":" + hash;
+  }
+
+  function verifyPin(pin, storedHash, user) {
+    // Older JSON clients could submit a numeric PIN; preserve that spelling.
+    if (typeof pin === "number" && Number.isSafeInteger(pin) && pin >= 0) pin = String(pin);
+    if (typeof pin !== "string" || typeof storedHash !== "string") return false;
+    var migratedHash = serverPin.resolve(storedHash, user, deps.loadConfig);
+    if (migratedHash) return serverPin.verify(pin, migratedHash);
+    var expected;
+    var actual;
+    if (/^[a-f0-9]{64}$/.test(storedHash)) {
+      expected = Buffer.from(storedHash, "hex");
+      actual = crypto.createHash("sha256").update("clay-user:" + pin).digest();
+    } else {
+      var parts = /^scrypt-v1:([a-f0-9]{32}):([a-f0-9]{128})$/.exec(storedHash);
+      if (!parts) return false;
+      expected = Buffer.from(parts[2], "hex");
+      actual = crypto.scryptSync("clay-user:" + pin, parts[1], 64, { N: 16384, r: 8, p: 1 });
+    }
+    return crypto.timingSafeEqual(actual, expected);
   }
 
   // Generate a random 6-digit PIN
@@ -96,6 +119,7 @@ function attachAuth(deps) {
   // --- Authentication ---
 
   function authenticateUser(username, pin) {
+    if (typeof username !== "string") return null;
     var data = loadUsers();
     var user = null;
     for (var i = 0; i < data.users.length; i++) {
@@ -105,8 +129,18 @@ function attachAuth(deps) {
       }
     }
     if (!user) return null;
-    var pinH = hashPin(pin);
-    if (user.pinHash !== pinH) return null;
+    if (!verifyPin(pin, user.pinHash, user)) return null;
+    if (user.pinHash.indexOf('scrypt-v1:') !== 0) {
+      var previousHash = user.pinHash;
+      try {
+        user.pinHash = hashPin(pin);
+        saveUsers(data);
+      } catch (e) {
+        // A best-effort upgrade must never reject a verified existing PIN.
+        user.pinHash = previousHash;
+        console.error("[users] PIN hash upgrade could not be saved; it will be retried on login.");
+      }
+    }
     return user;
   }
 
@@ -136,6 +170,7 @@ function attachAuth(deps) {
     clearSetupCode: clearSetupCode,
     validateSetupCode: validateSetupCode,
     hashPin: hashPin,
+    verifyPin: verifyPin,
     generatePin: generatePin,
     authenticateUser: authenticateUser,
     generateUserAuthToken: generateUserAuthToken,

package/lib/users-create.js

@@ -0,0 +1,97 @@
+var crypto = require("crypto");
+var serverPin = require("./users-server-pin");
+
+function attachCreation(deps) {
+  var loadUsers = deps.loadUsers;
+  var saveUsers = deps.saveUsers;
+  var generateUserId = deps.generateUserId;
+  var ensureUserBuiltinMates = deps.ensureUserBuiltinMates;
+  var auth = deps.auth;
+
+  function createUser(opts) {
+    var data = loadUsers();
+    // Check username uniqueness
+    for (var i = 0; i < data.users.length; i++) {
+      if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
+        return { error: "This username is already taken" };
+      }
+    }
+    // Check email uniqueness (when provided)
+    if (opts.email) {
+      for (var i = 0; i < data.users.length; i++) {
+        if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
+          return { error: "This email is already registered" };
+        }
+      }
+    }
+    var user = {
+      id: generateUserId(),
+      username: opts.username,
+      email: opts.email || null,
+      displayName: opts.displayName || opts.username,
+      pinHash: auth.hashPin(opts.pin),
+      role: opts.role || "user",
+      mustChangePin: !!opts.mustChangePin,
+      createdAt: Date.now(),
+      linuxUser: opts.linuxUser || null,
+      profile: opts.profile || {
+        name: opts.displayName || opts.username,
+        lang: "en-US",
+        avatarColor: "#5857fc",
+        avatarStyle: "imprint",
+        avatarSeed: crypto.randomBytes(4).toString("hex"),
+      },
+    };
+    data.users.push(user);
+    saveUsers(data);
+
+    // Seed immediately for ordinary multi-user storage. OS-user provisioning
+    // calls this again after the Linux mapping exists, targeting its final home.
+    ensureUserBuiltinMates(user.id);
+
+    return { ok: true, user: user };
+  }
+
+  function createUserWithoutPin(opts, migration) {
+    var data = loadUsers();
+    for (var i = 0; i < data.users.length; i++) {
+      if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
+        return { error: "This username is already taken" };
+      }
+    }
+    if (opts.email) {
+      for (var i = 0; i < data.users.length; i++) {
+        if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
+          return { error: "This email is already registered" };
+        }
+      }
+    }
+    var user = {
+      id: generateUserId(),
+      username: opts.username,
+      email: opts.email || null,
+      displayName: opts.displayName || opts.username,
+      pinHash: migration && migration.pinHash ? serverPin.tag(migration.pinHash) : null,
+      role: opts.role || "user",
+      createdAt: Date.now(),
+      profile: opts.profile || {
+        name: opts.displayName || opts.username,
+        lang: "en-US",
+        avatarColor: "#5857fc",
+        avatarStyle: "imprint",
+        avatarSeed: crypto.randomBytes(4).toString("hex"),
+      },
+    };
+    data.users.push(user);
+    if (migration) { data.multiUser = true; data.setupCode = null; }
+    saveUsers(data);
+
+    ensureUserBuiltinMates(user.id);
+
+    return { ok: true, user: user };
+  }
+
+  return { createUser: createUser, createUserWithoutPin: createUserWithoutPin };
+}
+
+module.exports = { attachCreation: attachCreation };

package/lib/users-server-pin.js

@@ -0,0 +1,37 @@
+var crypto = require('crypto');
+var PREFIX = 'server-pin-v1:';
+
+function isServerHash(hash) {
+  return typeof hash === 'string' && (/^[a-f0-9]{64}$/.test(hash) || /^[a-f0-9]{32}:[a-f0-9]{128}$/.test(hash));
+}
+
+function tag(hash) {
+  if (!isServerHash(hash)) throw new Error('Invalid legacy server PIN hash');
+  return PREFIX + hash;
+}
+
+function resolve(hash, user, loadConfig) {
+  if (typeof hash !== 'string') return null;
+  if (hash.indexOf(PREFIX) === 0) {
+    var original = hash.slice(PREFIX.length);
+    return isServerHash(original) ? original : null;
+  }
+  if (!user || !isServerHash(hash) || typeof loadConfig !== 'function') return null;
+  // Only the recorded migrated owner may use an untagged server credential.
+  var config;
+  try { config = loadConfig(); } catch (e) { return null; }
+  if (config && config.singleUserMigratedAt && config.singleUserMigratedUserId === user.id && config.pinHash === hash) return hash;
+  return null;
+}
+
+function verify(pin, hash) {
+  if (!isServerHash(hash)) return false;
+  var parts = hash.split(':');
+  var expected = Buffer.from(parts.length === 2 ? parts[1] : hash, 'hex');
+  var actual = parts.length === 2
+    ? crypto.scryptSync('clay:' + pin, parts[0], 64)
+    : crypto.createHash('sha256').update('clay:' + pin).digest();
+  return crypto.timingSafeEqual(actual, expected);
+}
+
+module.exports = { tag: tag, resolve: resolve, verify: verify };

package/lib/users.js

@@ -71,50 +71,6 @@ function ensureUserBuiltinMates(userId) {
   }
 }
 
-function createUser(opts) {
-  var data = loadUsers();
-  // Check username uniqueness
-  for (var i = 0; i < data.users.length; i++) {
-    if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
-      return { error: "This username is already taken" };
-    }
-  }
-  // Check email uniqueness (when provided)
-  if (opts.email) {
-    for (var i = 0; i < data.users.length; i++) {
-      if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
-        return { error: "This email is already registered" };
-      }
-    }
-  }
-  var user = {
-    id: generateUserId(),
-    username: opts.username,
-    email: opts.email || null,
-    displayName: opts.displayName || opts.username,
-    pinHash: auth.hashPin(opts.pin),
-    role: opts.role || "user",
-    mustChangePin: !!opts.mustChangePin,
-    createdAt: Date.now(),
-    linuxUser: opts.linuxUser || null,
-    profile: opts.profile || {
-      name: opts.displayName || opts.username,
-      lang: "en-US",
-      avatarColor: "#5857fc",
-      avatarStyle: "imprint",
-      avatarSeed: crypto.randomBytes(4).toString("hex"),
-    },
-  };
-  data.users.push(user);
-  saveUsers(data);
-
-  // Seed immediately for ordinary multi-user storage. OS-user provisioning
-  // calls this again after the Linux mapping exists, targeting its final home.
-  ensureUserBuiltinMates(user.id);
-
-  return { ok: true, user: user };
-}
-
 function createAdmin(opts) {
   return createUser({
     username: opts.username,
@@ -188,7 +144,7 @@ function getSoloNoPinUser() {
   var data = loadUsers();
   if (!data.users || data.users.length !== 1) return null;
   var u = data.users[0];
-  if (u.pinHash) return null;
+  if (u.pinHash || u.passwordHash || data.accountAuthMethod === 'password') return null;
   return u;
 }
 
@@ -224,6 +180,11 @@ function updateUserPin(userId, newPin) {
   for (var i = 0; i < data.users.length; i++) {
     if (data.users[i].id === userId) {
       data.users[i].pinHash = auth.hashPin(newPin);
+      if (data.accountAuthMethod === 'password') {
+        delete data.users[i].passwordHash;
+        delete data.users[i].passkeys;
+        delete data.users[i].passkeyUserHandle;
+      }
       data.users[i].mustChangePin = false;
       saveUsers(data);
       return { ok: true };
@@ -306,44 +267,6 @@ function createInvite(createdByUserId, targetEmail) {
   return invite;
 }
 
-function createUserWithoutPin(opts) {
-  var data = loadUsers();
-  for (var i = 0; i < data.users.length; i++) {
-    if (data.users[i].username.toLowerCase() === opts.username.toLowerCase()) {
-      return { error: "This username is already taken" };
-    }
-  }
-  if (opts.email) {
-    for (var i = 0; i < data.users.length; i++) {
-      if (data.users[i].email && data.users[i].email.toLowerCase() === opts.email.toLowerCase()) {
-        return { error: "This email is already registered" };
-      }
-    }
-  }
-  var user = {
-    id: generateUserId(),
-    username: opts.username,
-    email: opts.email || null,
-    displayName: opts.displayName || opts.username,
-    pinHash: null,
-    role: opts.role || "user",
-    createdAt: Date.now(),
-    profile: opts.profile || {
-      name: opts.displayName || opts.username,
-      lang: "en-US",
-      avatarColor: "#5857fc",
-      avatarStyle: "imprint",
-      avatarSeed: crypto.randomBytes(4).toString("hex"),
-    },
-  };
-  data.users.push(user);
-  saveUsers(data);
-
-  ensureUserBuiltinMates(user.id);
-
-  return { ok: true, user: user };
-}
-
 function findInvite(code) {
   var data = loadUsers();
   for (var i = 0; i < data.invites.length; i++) {
@@ -400,7 +323,10 @@ function removeExpiredInvites() {
 
 // --- Wire extracted modules ---
 
-var auth = attachAuth({ loadUsers: loadUsers, saveUsers: saveUsers, findAdmin: findAdmin });
+var auth = attachAuth({ loadUsers: loadUsers, saveUsers: saveUsers, findAdmin: findAdmin, loadConfig: require('./config').loadConfig });
+var creation = require("./users-create").attachCreation({ loadUsers: loadUsers, saveUsers: saveUsers, generateUserId: generateUserId, ensureUserBuiltinMates: ensureUserBuiltinMates, auth: auth });
+var createUser = creation.createUser;
+var createUserWithoutPin = creation.createUserWithoutPin;
 var permissions = attachPermissions({ loadUsers: loadUsers, saveUsers: saveUsers, findUserById: findUserById });
 var preferences = attachPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
 var projectMateFilterPreferences = attachProjectMateFilterPreferences({ loadUsers: loadUsers, saveUsers: saveUsers });
@@ -489,6 +415,7 @@ module.exports = {
   validateSetupCode: validateSetupCode,
   generateUserId: generateUserId,
   hashPin: hashPin,
+  verifyPin: auth.verifyPin,
   createUser: createUser,
   createAdmin: createAdmin,
   findAdmin: findAdmin,

package/lib/workspace-query-service.js

@@ -168,6 +168,13 @@ function attachWorkspaceQueryService(ctx) {
     } else if (source.session.ownerId) {
       return null;
     }
+    if (source.viewerId !== undefined) {
+      var viewerPrincipal = {
+        userId: isMultiUser() ? source.viewerId : null,
+        singleUserOwnerId: isMultiUser() ? null : source.viewerId,
+      };
+      if (!ownsSession(viewerPrincipal, source.session)) return null;
+    }
     return createBound({
       userId: isMultiUser() ? source.session.ownerId : null,
       sourceProjectSlug: source.projectSlug,
@@ -366,11 +373,13 @@ function attachWorkspaceQueryService(ctx) {
 
   function resolveSessionNavigation(principal, ref) {
     if (typeof ref !== "string" || !/^session:[A-Za-z0-9_-]{24}$/.test(ref)) throw new Error("Invalid session reference.");
+    var entryIndex = arguments.length > 2 ? arguments[2] : null;
+    if (entryIndex !== null && entryIndex !== undefined && (!Number.isSafeInteger(entryIndex) || entryIndex < 0)) throw new Error("Invalid session entry reference.");
     var projects = collect(principal);
     for (var p = 0; p < projects.length; p++) {
       var session = findSession(projects[p], ref);
       if (!session) continue;
-      return {
+      var target = {
         projectSlug: projects[p].projectSlug,
         projectTitle: projects[p].projectTitle,
         isMate: projects[p].isMate,
@@ -379,6 +388,8 @@ function attachWorkspaceQueryService(ctx) {
         homeSessionId: session.cliSessionId || "local:" + session.localId,
         title: cleanMetadata(session.title || "New Session", 160),
       };
+      if (entryIndex !== null && entryIndex !== undefined) target.entryIndex = entryIndex;
+      return target;
     }
     throw new Error("Session not found in the owned workspace.");
   }
@@ -450,7 +461,7 @@ function attachWorkspaceQueryService(ctx) {
         if (!principal.isClay) throw new Error("Workspace-wide activity is available only to builtin Clay.");
         return workspaceActivity(principal, args || {});
       },
-      resolveSessionNavigation: function (args) { return resolveSessionNavigation(principal, args && args.sessionRef); },
+      resolveSessionNavigation: function (args) { return resolveSessionNavigation(principal, args && args.sessionRef, args && args.entryIndex); },
       listRecentDecisions: function (args) {
         if (!principal.isClay) throw new Error("Workspace decisions are available only to builtin Clay.");
         return recentDecisions(principal, args || {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "5.1.1-beta.1",
+  "version": "5.2.0-beta.2",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"
@@ -60,6 +60,7 @@
     "@modelcontextprotocol/sdk": "^1.32.1",
     "@openai/codex": "^0.162.1",
     "@seald-io/nedb": "^4.1.2",
+    "@simplewebauthn/server": "13.3.3",
     "codemirror": "^5.65.21",
     "imapflow": "^1.7.8",
     "ipaddr.js": "^2.5.0",