clay-server 2.22.0-beta.2 → 2.22.0-beta.4

package/bin/cli.js

@@ -1546,6 +1546,7 @@ async function forkDaemon(mode, keepAwake, extraProjects, addCwd, wantOsUsers) {
     builtinCert: hasBuiltinCert,
     mkcertDetected: mkcertDetected,
     debug: debugMode,
+    headless: headlessMode,
     keepAwake: keepAwake,
     dangerouslySkipPermissions: dangerouslySkipPermissions,
     osUsers: wantOsUsers || osUsersMode,

package/lib/daemon.js

@@ -98,14 +98,6 @@ if (config.tls) {
 }
 
 var caRoot = null;
-try {
-  var { execSync } = require("child_process");
-  caRoot = path.join(
-    execSync("mkcert -CAROOT", { encoding: "utf8", stdio: "pipe" }).trim(),
-    "rootCA.pem"
-  );
-  if (!fs.existsSync(caRoot)) caRoot = null;
-} catch (e) {}
 
 // --- Resolve LAN IP for share URL ---
 var os2 = require("os");
@@ -160,11 +152,10 @@ var relay = createServer({
     var slugs = config.projects.map(function (p) { return p.slug; });
     var slug = generateSlug(absPath, slugs);
     relay.addProject(absPath, slug);
-    var projectEntry = { path: absPath, slug: slug, addedAt: Date.now() };
-    // Non-admin users own their projects and they default to private
-    if (wsUser && wsUser.id && wsUser.role !== "admin") {
+    var projectEntry = { path: absPath, slug: slug, addedAt: Date.now(), visibility: "private" };
+    // The user who adds a project always becomes the owner
+    if (wsUser && wsUser.id) {
       projectEntry.ownerId = wsUser.id;
-      projectEntry.visibility = "private";
     }
     config.projects.push(projectEntry);
     // Remove from removedProjects if present
@@ -237,15 +228,10 @@ var relay = createServer({
       try { fs.rmSync(targetDir, { recursive: true, force: true }); } catch (ce) {}
       return { ok: false, error: "Failed to create project: " + e.message };
     }
-    // Register project
-    var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now() };
+    // Register project - creator always becomes owner, default private
+    var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now(), visibility: "private" };
     if (wsUser && wsUser.id) {
-      if (config.osUsers || wsUser.role !== "admin") {
-        projectEntry.ownerId = wsUser.id;
-      }
-      if (wsUser.role !== "admin") {
-        projectEntry.visibility = "private";
-      }
+      projectEntry.ownerId = wsUser.id;
     }
     relay.addProject(targetDir, slug);
     config.projects.push(projectEntry);
@@ -312,15 +298,11 @@ var relay = createServer({
           execSync("chown -R " + wsUser.linuxUser + ":" + wsUser.linuxUser + " " + JSON.stringify(targetDir));
         } catch (e) {}
       }
-      // Register project
-      var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now() };
+      // Register project - creator always becomes owner
+      // Creator always becomes owner, default private
+      var projectEntry = { path: targetDir, slug: slug, addedAt: Date.now(), visibility: "private" };
       if (wsUser && wsUser.id) {
-        if (config.osUsers || wsUser.role !== "admin") {
-          projectEntry.ownerId = wsUser.id;
-        }
-        if (wsUser.role !== "admin") {
-          projectEntry.visibility = "private";
-        }
+        projectEntry.ownerId = wsUser.id;
       }
       relay.addProject(targetDir, slug);
       config.projects.push(projectEntry);
@@ -665,6 +647,7 @@ var relay = createServer({
       port: config.port,
       tls: !!tlsOptions,
       debug: !!config.debug,
+      headless: !!config.headless,
       keepAwake: !!config.keepAwake,
       autoContinueOnRateLimit: !!config.autoContinueOnRateLimit,
       pinEnabled: !!config.pinHash,
@@ -1041,7 +1024,7 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       var slugs = config.projects.map(function (p) { return p.slug; });
       var slug = generateSlug(absPath, slugs);
       relay.addProject(absPath, slug);
-      config.projects.push({ path: absPath, slug: slug, addedAt: Date.now() });
+      config.projects.push({ path: absPath, slug: slug, addedAt: Date.now(), visibility: "private" });
       saveConfig(config);
       try { syncClayrc(config.projects); } catch (e) {}
       console.log("[daemon] Added project:", slug, "→", absPath);
@@ -1192,6 +1175,10 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       return { ok: true };
 
     case "update": {
+      if (config.headless) {
+        console.log("[daemon] Update & restart requested via IPC — blocked (headless mode)");
+        return { ok: false, error: "Auto-update is disabled in headless mode" };
+      }
       console.log("[daemon] Update & restart requested via IPC");
 
       // Dev mode (config.debug): just exit with code 120, cli.js dev watcher respawns daemon

package/lib/project.js

@@ -1171,6 +1171,15 @@ function createProjectContext(opts) {
       setTimeout(function() { resumeLoop(); }, 500);
     }
 
+    // Auto-assign owner if project has none and a user connects (e.g. IPC-added projects)
+    if (!projectOwnerId && ws._clayUser && ws._clayUser.id && !isMate) {
+      projectOwnerId = ws._clayUser.id;
+      if (opts.onProjectOwnerChanged) {
+        opts.onProjectOwnerChanged(slug, projectOwnerId);
+      }
+      console.log("[project] Auto-assigned owner for " + slug + ": " + projectOwnerId);
+    }
+
     // Send cached state
     var _userId = ws._clayUser ? ws._clayUser.id : null;
     var _filteredProjects = getProjectList(_userId);

package/lib/public/app.js

@@ -2212,6 +2212,9 @@ import { initDebate, handleDebateStarted, handleDebateResumed, handleDebateTurn,
       sendBtn.disabled = false;
       setSendBtnMode("send");
       connectOverlay.classList.add("hidden");
+      // Hide update banner on reconnect; server will re-send update_available if still needed
+      var updPill = $("update-pill-wrap");
+      if (updPill) updPill.classList.add("hidden");
       stopVerbCycle();
     } else if (status === "processing") {
       if (dot) { dot.classList.add("connected"); dot.classList.add("processing"); }
@@ -4024,6 +4027,48 @@ import { initDebate, handleDebateStarted, handleDebateResumed, handleDebateTurn,
       if (savedMainWs === this) return;
     };
 
+    function showUpdateAvailable(msg) {
+      var updatePillWrap = $("update-pill-wrap");
+      var updateVersion = $("update-version");
+      if (updatePillWrap && updateVersion && msg.version) {
+        updateVersion.textContent = "v" + msg.version;
+        updatePillWrap.classList.remove("hidden");
+        var updPill = $("update-pill");
+        var updResetBtn = $("update-now");
+        if (isHeadlessMode) {
+          // In headless mode, hide auto-update button and show manual guide only
+          if (updPill) updPill.innerHTML = '<i data-lucide="arrow-up-circle"></i> <span id="update-version">v' + msg.version + '</span> available. Update manually';
+          if (updResetBtn) updResetBtn.style.display = "none";
+        } else {
+          // Reset button state (may be stuck on "Updating..." after restart)
+          if (updResetBtn) {
+            updResetBtn.innerHTML = '<i data-lucide="download"></i> Update now';
+            updResetBtn.disabled = false;
+            updResetBtn.style.display = "";
+          }
+        }
+        // Update manual command based on version (beta vs stable)
+        var updManualCmd = $("update-manual-cmd");
+        if (updManualCmd) {
+          var updTag = msg.version.indexOf("-beta") !== -1 ? "beta" : "latest";
+          updManualCmd.textContent = "npx clay-server@" + updTag;
+        }
+        refreshIcons();
+      }
+      // Update the settings check-for-updates button
+      var settingsUpdBtn = $("settings-update-check");
+      if (settingsUpdBtn && msg.version) {
+        settingsUpdBtn.innerHTML = "";
+        var ic = document.createElement("i");
+        ic.setAttribute("data-lucide", "arrow-up-circle");
+        settingsUpdBtn.appendChild(ic);
+        settingsUpdBtn.appendChild(document.createTextNode(" Update available (v" + msg.version + ")"));
+        settingsUpdBtn.classList.add("settings-btn-update-available");
+        settingsUpdBtn.disabled = false;
+        refreshIcons();
+      }
+    }
+
     ws.onmessage = function (event) {
       // If this WS is stashed while in mate DM, only allow skill_installed through
       if (savedMainWs === this) {
@@ -4173,36 +4218,14 @@ import { initDebate, handleDebateStarted, handleDebateResumed, handleDebateTurn,
           break;
 
         case "update_available":
-          var updatePillWrap = $("update-pill-wrap");
-          var updateVersion = $("update-version");
-          if (updatePillWrap && updateVersion && msg.version) {
-            updateVersion.textContent = "v" + msg.version;
-            updatePillWrap.classList.remove("hidden");
-            // Reset button state (may be stuck on "Updating..." after restart)
-            var updResetBtn = $("update-now");
-            if (updResetBtn) {
-              updResetBtn.innerHTML = '<i data-lucide="download"></i> Update now';
-              updResetBtn.disabled = false;
-            }
-            // Update manual command based on version (beta vs stable)
-            var updManualCmd = $("update-manual-cmd");
-            if (updManualCmd) {
-              var updTag = msg.version.indexOf("-beta") !== -1 ? "beta" : "latest";
-              updManualCmd.textContent = "npx clay-server@" + updTag;
-            }
-            refreshIcons();
-          }
-          // Update the settings check-for-updates button
-          var settingsUpdBtn = $("settings-update-check");
-          if (settingsUpdBtn && msg.version) {
-            settingsUpdBtn.innerHTML = "";
-            var ic = document.createElement("i");
-            ic.setAttribute("data-lucide", "arrow-up-circle");
-            settingsUpdBtn.appendChild(ic);
-            settingsUpdBtn.appendChild(document.createTextNode(" Update available (v" + msg.version + ")"));
-            settingsUpdBtn.classList.add("settings-btn-update-available");
-            settingsUpdBtn.disabled = false;
-            refreshIcons();
+          // In multi-user mode, only show update UI to admins
+          if (isMultiUserMode) {
+            checkAdminAccess().then(function (isAdmin) {
+              if (!isAdmin) return;
+              showUpdateAvailable(msg);
+            });
+          } else {
+            showUpdateAvailable(msg);
           }
           break;
 
@@ -5147,6 +5170,7 @@ import { initDebate, handleDebateStarted, handleDebateResumed, handleDebateTurn,
           break;
 
         case "daemon_config":
+          if (msg.config && msg.config.headless) isHeadlessMode = true;
           updateDaemonConfig(msg.config);
           break;
 
@@ -5634,6 +5658,7 @@ import { initDebate, handleDebateStarted, handleDebateResumed, handleDebateTurn,
 
   // --- Admin (multi-user mode) ---
   var isMultiUserMode = false;
+  var isHeadlessMode = false;
   var myUserId = null;
   initAdmin({
     get projectList() { return cachedProjects; },

package/lib/public/css/icon-strip.css

@@ -498,6 +498,113 @@
 .project-ctx-item.project-ctx-delete { color: var(--error); }
 .project-ctx-item.project-ctx-delete:hover { background: var(--error-8); }
 
+/* --- Project Access Popover --- */
+.project-access-popover {
+  position: fixed;
+  background: var(--sidebar-bg);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  padding: 0;
+  width: 260px;
+  box-shadow: 0 8px 30px rgba(var(--shadow-rgb), 0.35);
+  z-index: 9999;
+  animation: ctxMenuAppear 0.12s ease-out;
+  overflow: hidden;
+}
+.project-access-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 12px 14px 8px;
+  border-bottom: 1px solid var(--border);
+}
+.project-access-title {
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text);
+}
+.project-access-close {
+  background: none;
+  border: none;
+  color: var(--text-secondary);
+  font-size: 18px;
+  cursor: pointer;
+  padding: 0 2px;
+  line-height: 1;
+}
+.project-access-close:hover { color: var(--text); }
+.project-access-section {
+  padding: 10px 14px;
+}
+.project-access-label {
+  display: block;
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--text-secondary);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  margin-bottom: 6px;
+}
+.project-access-vis-row {
+  display: flex;
+  gap: 6px;
+}
+.project-access-vis-btn {
+  flex: 1;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  padding: 7px 0;
+  font-size: 12px;
+  font-family: inherit;
+  color: var(--text-secondary);
+  background: rgba(var(--overlay-rgb), 0.04);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  cursor: pointer;
+  transition: all 0.15s;
+}
+.project-access-vis-btn .lucide { width: 14px; height: 14px; }
+.project-access-vis-btn:hover { background: rgba(var(--overlay-rgb), 0.08); }
+.project-access-vis-btn.active {
+  background: var(--accent-8, rgba(99, 102, 241, 0.08));
+  border-color: var(--accent, #6366f1);
+  color: var(--accent, #6366f1);
+  font-weight: 500;
+}
+.project-access-user-list {
+  max-height: 200px;
+  overflow-y: auto;
+}
+.project-access-user-item {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 5px 0;
+  font-size: 13px;
+  color: var(--text);
+  cursor: pointer;
+}
+.project-access-user-item input[type="checkbox"] {
+  accent-color: var(--accent, #6366f1);
+  width: 15px;
+  height: 15px;
+  cursor: pointer;
+}
+.project-access-user-item:hover { color: var(--text); }
+.project-access-empty {
+  font-size: 12px;
+  color: var(--text-tertiary);
+  padding: 8px 0;
+}
+.project-access-loading {
+  padding: 20px 14px;
+  text-align: center;
+  font-size: 12px;
+  color: var(--text-secondary);
+}
+
 /* --- Emoji picker popover --- */
 .emoji-picker {
   position: fixed;

package/lib/public/modules/sidebar.js

@@ -2672,6 +2672,158 @@ var EMOJI_CATEGORIES = [
   ]},
 ];
 
+// --- Project Access Popover ---
+var projectAccessPopover = null;
+
+function closeProjectAccessPopover() {
+  if (projectAccessPopover) {
+    projectAccessPopover.remove();
+    projectAccessPopover = null;
+    document.removeEventListener("click", closeAccessOnOutside);
+    document.removeEventListener("keydown", closeAccessOnEscape);
+  }
+}
+
+function closeAccessOnOutside(e) {
+  if (projectAccessPopover && !projectAccessPopover.contains(e.target)) closeProjectAccessPopover();
+}
+function closeAccessOnEscape(e) {
+  if (e.key === "Escape") closeProjectAccessPopover();
+}
+
+function showProjectAccessPopover(anchorEl, slug) {
+  closeProjectAccessPopover();
+
+  var popover = document.createElement("div");
+  popover.className = "project-access-popover";
+  popover.innerHTML = '<div class="project-access-loading">Loading...</div>';
+  popover.addEventListener("click", function (e) { e.stopPropagation(); });
+  document.body.appendChild(popover);
+  projectAccessPopover = popover;
+
+  // Position near anchor
+  requestAnimationFrame(function () {
+    var rect = anchorEl.getBoundingClientRect();
+    popover.style.position = "fixed";
+    popover.style.left = (rect.right + 8) + "px";
+    popover.style.top = rect.top + "px";
+    popover.style.zIndex = "9999";
+    var popRect = popover.getBoundingClientRect();
+    if (popRect.right > window.innerWidth - 8) {
+      popover.style.left = (rect.left - popRect.width - 8) + "px";
+    }
+    if (popRect.bottom > window.innerHeight - 8) {
+      popover.style.top = (window.innerHeight - popRect.height - 8) + "px";
+    }
+  });
+
+  setTimeout(function () {
+    document.addEventListener("click", closeAccessOnOutside);
+    document.addEventListener("keydown", closeAccessOnEscape);
+  }, 0);
+
+  // Fetch access info and user list in parallel
+  Promise.all([
+    fetch("/api/admin/projects/" + encodeURIComponent(slug) + "/access").then(function (r) { return r.json(); }),
+    fetch("/api/admin/users").then(function (r) { return r.json(); }),
+  ]).then(function (results) {
+    var access = results[0];
+    var usersData = results[1];
+    if (access.error || usersData.error) {
+      popover.innerHTML = '<div class="project-access-loading">Failed to load</div>';
+      return;
+    }
+    renderAccessPopover(popover, slug, access, usersData.users || []);
+  }).catch(function () {
+    popover.innerHTML = '<div class="project-access-loading">Failed to load</div>';
+  });
+}
+
+function renderAccessPopover(popover, slug, access, allUsers) {
+  var visibility = access.visibility || "public";
+  var allowedUsers = access.allowedUsers || [];
+  var ownerId = access.ownerId;
+
+  // Filter out the owner from the user list (owner always has access)
+  var selectableUsers = allUsers.filter(function (u) { return u.id !== ownerId; });
+
+  var html = '';
+  html += '<div class="project-access-header">';
+  html += '<span class="project-access-title">Project Access</span>';
+  html += '<button class="project-access-close">&times;</button>';
+  html += '</div>';
+
+  // Visibility toggle
+  html += '<div class="project-access-section">';
+  html += '<label class="project-access-label">Visibility</label>';
+  html += '<div class="project-access-vis-row">';
+  html += '<button class="project-access-vis-btn' + (visibility === "private" ? ' active' : '') + '" data-vis="private">';
+  html += iconHtml("lock") + ' Private';
+  html += '</button>';
+  html += '<button class="project-access-vis-btn' + (visibility === "public" ? ' active' : '') + '" data-vis="public">';
+  html += iconHtml("globe") + ' Public';
+  html += '</button>';
+  html += '</div>';
+  html += '</div>';
+
+  // Allowed users (only when private)
+  html += '<div class="project-access-section project-access-users-section"' + (visibility !== "private" ? ' style="display:none"' : '') + '>';
+  html += '<label class="project-access-label">Allowed Users</label>';
+  html += '<div class="project-access-user-list">';
+  for (var i = 0; i < selectableUsers.length; i++) {
+    var u = selectableUsers[i];
+    var checked = allowedUsers.indexOf(u.id) !== -1 ? " checked" : "";
+    html += '<label class="project-access-user-item">';
+    html += '<input type="checkbox" data-uid="' + u.id + '"' + checked + '>';
+    html += '<span>' + escapeHtml(u.displayName || u.username || u.id) + '</span>';
+    html += '</label>';
+  }
+  if (selectableUsers.length === 0) {
+    html += '<div class="project-access-empty">No other users</div>';
+  }
+  html += '</div>';
+  html += '</div>';
+
+  popover.innerHTML = html;
+  refreshIcons();
+
+  // Close button
+  popover.querySelector(".project-access-close").addEventListener("click", function () {
+    closeProjectAccessPopover();
+  });
+
+  // Visibility toggle
+  popover.querySelectorAll(".project-access-vis-btn").forEach(function (btn) {
+    btn.addEventListener("click", function () {
+      var newVis = btn.dataset.vis;
+      popover.querySelectorAll(".project-access-vis-btn").forEach(function (b) { b.classList.remove("active"); });
+      btn.classList.add("active");
+      var usersSection = popover.querySelector(".project-access-users-section");
+      if (usersSection) usersSection.style.display = newVis === "private" ? "" : "none";
+      fetch("/api/admin/projects/" + encodeURIComponent(slug) + "/visibility", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ visibility: newVis }),
+      });
+    });
+  });
+
+  // User checkboxes
+  popover.querySelectorAll('.project-access-user-item input[type="checkbox"]').forEach(function (cb) {
+    cb.addEventListener("change", function () {
+      var selected = [];
+      popover.querySelectorAll('.project-access-user-item input[type="checkbox"]:checked').forEach(function (c) {
+        selected.push(c.dataset.uid);
+      });
+      fetch("/api/admin/projects/" + encodeURIComponent(slug) + "/users", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ allowedUsers: selected }),
+      });
+    });
+  });
+}
+
 function closeProjectCtxMenu() {
   if (projectCtxMenu) {
     projectCtxMenu.remove();
@@ -2797,6 +2949,23 @@ function showProjectCtxMenu(anchorEl, slug, name, icon, position) {
   });
   menu.appendChild(shareItem);
 
+  // --- Manage Access (owner or admin, multi-user only) ---
+  if (ctx.multiUser && slug.indexOf("--") === -1) {
+    var isProjectOwner = ctx.myUserId && ctx.projectOwnerId && ctx.myUserId === ctx.projectOwnerId;
+    var isAdmin = ctx.permissions && ctx.permissions.projectSettings !== false;
+    if (isProjectOwner || isAdmin) {
+      var accessItem = document.createElement("button");
+      accessItem.className = "project-ctx-item";
+      accessItem.innerHTML = iconHtml("users") + " <span>Manage Access</span>";
+      accessItem.addEventListener("click", function (e) {
+        e.stopPropagation();
+        closeProjectCtxMenu();
+        showProjectAccessPopover(anchorEl, slug);
+      });
+      menu.appendChild(accessItem);
+    }
+  }
+
   if (!ctx.permissions || ctx.permissions.deleteProject !== false) {
     // --- Separator ---
     var sep = document.createElement("div");

package/lib/server.js

@@ -1512,13 +1512,23 @@ function createServer(opts) {
         return;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
-        res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+      if (!mu) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end('{"error":"Authentication required"}');
         return;
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ users: users.getAllUsers() }));
+      // Admins get full user list; project owners get limited list (id, displayName, username)
+      if (mu.role === "admin") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ users: users.getAllUsers() }));
+      } else {
+        var allU = users.getAllUsers();
+        var safeUsers = allU.map(function (u) {
+          return { id: u.id, displayName: u.displayName, username: u.username };
+        });
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ users: safeUsers }));
+      }
       return;
     }
 
@@ -1990,9 +2000,12 @@ function createServer(opts) {
         return;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
+      var _visSlug = fullUrl.split("/")[4];
+      var _visAccess = onGetProjectAccess ? onGetProjectAccess(_visSlug) : null;
+      var _isOwner = mu && _visAccess && _visAccess.ownerId && mu.id === _visAccess.ownerId;
+      if (!mu || (mu.role !== "admin" && !_isOwner)) {
         res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+        res.end('{"error":"Admin or project owner access required"}');
         return;
       }
       var projSlug = fullUrl.split("/")[4];
@@ -2092,9 +2105,12 @@ function createServer(opts) {
         return;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
+      var _usrSlug = fullUrl.split("/")[4];
+      var _usrAccess = onGetProjectAccess ? onGetProjectAccess(_usrSlug) : null;
+      var _isOwnerU = mu && _usrAccess && _usrAccess.ownerId && mu.id === _usrAccess.ownerId;
+      if (!mu || (mu.role !== "admin" && !_isOwnerU)) {
         res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+        res.end('{"error":"Admin or project owner access required"}');
         return;
       }
       var projSlug = fullUrl.split("/")[4];
@@ -2134,7 +2150,7 @@ function createServer(opts) {
       return;
     }
 
-    // Get project access info (admin only)
+    // Get project access info (admin or project owner)
     if (req.method === "GET" && /^\/api\/admin\/projects\/[a-z0-9_-]+\/access$/.test(fullUrl)) {
       if (!users.isMultiUser()) {
         res.writeHead(404, { "Content-Type": "application/json" });
@@ -2142,9 +2158,12 @@ function createServer(opts) {
         return;
       }
       var mu = getMultiUserFromReq(req);
-      if (!mu || mu.role !== "admin") {
+      var _accSlug = fullUrl.split("/")[4];
+      var _accAccess = onGetProjectAccess ? onGetProjectAccess(_accSlug) : null;
+      var _isOwnerA = mu && _accAccess && _accAccess.ownerId && mu.id === _accAccess.ownerId;
+      if (!mu || (mu.role !== "admin" && !_isOwnerA)) {
         res.writeHead(403, { "Content-Type": "application/json" });
-        res.end('{"error":"Admin access required"}');
+        res.end('{"error":"Admin or project owner access required"}');
         return;
       }
       var projSlug = fullUrl.split("/")[4];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.22.0-beta.2",
+  "version": "2.22.0-beta.4",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",