clay-server 2.11.0-beta.19 → 2.11.0-beta.20

package/lib/daemon.js

@@ -107,7 +107,7 @@ var relay = createServer({
   osUsers: config.osUsers || false,
   lanHost: lanIp ? lanIp + ":" + config.port : null,
   getRemovedProjects: function (userId) { return getFilteredRemovedProjects(userId); },
-  onAddProject: function (absPath) {
+  onAddProject: function (absPath, wsUser) {
     // Check if already registered
     for (var j = 0; j < config.projects.length; j++) {
       if (config.projects[j].path === absPath) {
@@ -117,7 +117,13 @@ var relay = createServer({
     var slugs = config.projects.map(function (p) { return p.slug; });
     var slug = generateSlug(absPath, slugs);
     relay.addProject(absPath, slug);
-    config.projects.push({ path: absPath, slug: slug, addedAt: Date.now() });
+    var projectEntry = { path: absPath, slug: slug, addedAt: Date.now() };
+    // Non-admin users own their projects and they default to private
+    if (wsUser && wsUser.id && wsUser.role !== "admin") {
+      projectEntry.ownerId = wsUser.id;
+      projectEntry.visibility = "private";
+    }
+    config.projects.push(projectEntry);
     // Remove from removedProjects if present
     if (config.removedProjects) {
       config.removedProjects = config.removedProjects.filter(function (rp) { return rp.path !== absPath; });
@@ -187,8 +193,13 @@ var relay = createServer({
     }
     // Register project
     var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now() };
-    if (config.osUsers && wsUser) {
-      projectEntry.ownerId = wsUser.id;
+    if (wsUser && wsUser.id) {
+      if (config.osUsers || wsUser.role !== "admin") {
+        projectEntry.ownerId = wsUser.id;
+      }
+      if (wsUser.role !== "admin") {
+        projectEntry.visibility = "private";
+      }
     }
     relay.addProject(targetDir, slug);
     config.projects.push(projectEntry);
@@ -254,8 +265,13 @@ var relay = createServer({
       }
       // Register project
       var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now() };
-      if (config.osUsers && wsUser) {
-        projectEntry.ownerId = wsUser.id;
+      if (wsUser && wsUser.id) {
+        if (config.osUsers || wsUser.role !== "admin") {
+          projectEntry.ownerId = wsUser.id;
+        }
+        if (wsUser.role !== "admin") {
+          projectEntry.visibility = "private";
+        }
       }
       relay.addProject(targetDir, slug);
       config.projects.push(projectEntry);

package/lib/project.js

@@ -1980,7 +1980,7 @@ function createProjectContext(opts) {
         return;
       }
       if (typeof opts.onAddProject === "function") {
-        var result = opts.onAddProject(addAbs);
+        var result = opts.onAddProject(addAbs, ws._clayUser);
         sendTo(ws, { type: "add_project_result", ok: result.ok, slug: result.slug, error: result.error, existing: result.existing });
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });

package/lib/sdk-bridge.js

@@ -571,20 +571,38 @@ function createSDKBridge(opts) {
 
   // --- Worker process management (OS-level multi-user) ---
 
-  // Copy sdk-worker.js to a world-readable temp location so OS-level users
-  // can execute it (the source may be under /root/.npm/_npx/ which is 700)
-  var WORKER_SCRIPT_SRC = path.join(__dirname, "sdk-worker.js");
-  var WORKER_SCRIPT = (function () {
-    var tmpWorker = path.join(os.tmpdir(), "clay-sdk-worker.js");
+  var WORKER_SCRIPT = path.join(__dirname, "sdk-worker.js");
+
+  // Ensure the package directory tree is world-readable so OS-level users
+  // can access the worker script and its dependencies (the install path
+  // may be under /root/.npm/_npx/ which defaults to 700)
+  (function ensurePackageReadable() {
     try {
-      // Always copy to ensure it stays in sync with the running version
-      fs.copyFileSync(WORKER_SCRIPT_SRC, tmpWorker);
-      fs.chmodSync(tmpWorker, 0o644);
-      return tmpWorker;
-    } catch (e) {
-      // Fallback to source path if copy fails
-      return WORKER_SCRIPT_SRC;
-    }
+      // Walk up from __dirname to find the package root (where node_modules lives)
+      var pkgDir = path.join(__dirname, "..");
+      // Open read+execute on each ancestor directory up to and including the
+      // npx cache entry so that non-root users can traverse the path
+      var dir = pkgDir;
+      var dirs = [];
+      while (dir !== path.dirname(dir)) {
+        dirs.push(dir);
+        // Stop once we leave the npm cache tree
+        if (dir.indexOf(".npm") === -1 && dir.indexOf("node_modules") === -1) break;
+        dir = path.dirname(dir);
+      }
+      for (var di = 0; di < dirs.length; di++) {
+        try {
+          var st = fs.statSync(dirs[di]);
+          // Add o+rx if not already present
+          if ((st.mode & 0o005) !== 0o005) {
+            fs.chmodSync(dirs[di], st.mode | 0o005);
+          }
+        } catch (e) {}
+      }
+      // Recursively make the package contents readable
+      var { execSync: chmodExec } = require("child_process");
+      chmodExec("chmod -R o+rX " + JSON.stringify(pkgDir), { stdio: "ignore", timeout: 5000 });
+    } catch (e) {}
   })();
 
   // resolveLinuxUser delegates to shared os-users utility
@@ -657,7 +675,7 @@ function createSDKBridge(opts) {
         HOME: userInfo.home,
         USER: linuxUser,
         PATH: process.env.PATH || "/usr/local/bin:/usr/bin:/bin",
-        NODE_PATH: path.join(__dirname, "..", "node_modules") + (process.env.NODE_PATH ? ":" + process.env.NODE_PATH : ""),
+        NODE_PATH: process.env.NODE_PATH || "",
         LANG: process.env.LANG || "en_US.UTF-8",
       };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.11.0-beta.19",
+  "version": "2.11.0-beta.20",
   "description": "Web UI for Claude Code. Any device. Push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",