clay-server 2.40.1-beta.1 → 2.41.0

package/lib/server-global-ws.js

@@ -0,0 +1,189 @@
+// --- Global WebSocket handler (no project context) ---
+//
+// Lets a logged-in user with no projects yet (or no accessible projects)
+// load the regular app shell and create / add / clone their first project,
+// instead of being trapped on a static "no projects" page.
+//
+// Bound to the slug-less `/ws` endpoint by lib/server.js. Only handles the
+// small set of messages needed to bootstrap into a project context:
+//   - ping            -> pong keep-alive
+//   - browse_dir      -> directory picker for the add-project modal
+//   - add_project     -> register an existing directory
+//   - create_project  -> make a new empty project
+//   - clone_project   -> clone a git repo into a new project
+//
+// All four mirror the same handlers in lib/project-sessions.js, but with
+// the per-project `ctx` dropped since none of them need it.
+
+var fs = require("fs");
+var path = require("path");
+var config = require("./config");
+
+// Mirrored from lib/project.js — keep in sync if entries change there.
+var IGNORED_DIRS = new Set([
+  "node_modules", ".git", ".next", "__pycache__",
+  ".cache", "dist", "build", ".clay", ".claude-relay",
+]);
+
+function sendTo(ws, msg) {
+  if (ws && ws.readyState === 1) {
+    try { ws.send(JSON.stringify(msg)); } catch (e) {}
+  }
+}
+
+function attachGlobalWs(opts) {
+  var osUsers = opts.osUsers || false;
+  var usersModule = opts.usersModule;
+  var onAddProject = opts.onAddProject;
+  var onCreateProject = opts.onCreateProject;
+  var onCloneProject = opts.onCloneProject;
+
+  function handleMessage(ws, msg) {
+    if (!msg || typeof msg !== "object") return;
+
+    if (msg.type === "ping") {
+      sendTo(ws, { type: "pong" });
+      return;
+    }
+
+    // --- Directory picker for the add-project modal ---
+    if (msg.type === "browse_dir") {
+      var rawPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
+      var absTarget = path.resolve(rawPath);
+      // Multi-user mode: non-admins can only browse their home directory.
+      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
+        var browseHome = ws._clayUser.linuxUser ? "/home/" + ws._clayUser.linuxUser : null;
+        if (!browseHome || (absTarget !== browseHome && (absTarget + "/").indexOf(browseHome + "/") !== 0)) {
+          sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: [], error: "Access restricted to your home directory" });
+          return;
+        }
+      }
+      var parentDir, prefix;
+      try {
+        var stat = fs.statSync(absTarget);
+        if (stat.isDirectory()) {
+          // Existing directory -- list its children.
+          parentDir = absTarget;
+          prefix = "";
+        } else {
+          parentDir = path.dirname(absTarget);
+          prefix = path.basename(absTarget).toLowerCase();
+        }
+      } catch (e) {
+        // Doesn't exist -- list parent and filter by typed prefix.
+        parentDir = path.dirname(absTarget);
+        prefix = path.basename(absTarget).toLowerCase();
+      }
+      try {
+        var dirItems = fs.readdirSync(parentDir, { withFileTypes: true });
+        var dirEntries = [];
+        for (var di = 0; di < dirItems.length; di++) {
+          var d = dirItems[di];
+          if (!d.isDirectory()) continue;
+          if (d.name.charAt(0) === ".") continue;
+          if (IGNORED_DIRS.has(d.name)) continue;
+          if (prefix && !d.name.toLowerCase().startsWith(prefix)) continue;
+          dirEntries.push({ name: d.name, path: path.join(parentDir, d.name) });
+        }
+        dirEntries.sort(function (a, b) { return a.name.localeCompare(b.name); });
+        sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: dirEntries });
+      } catch (e) {
+        sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: [], error: e.message });
+      }
+      return;
+    }
+
+    // --- Register an existing directory as a project ---
+    if (msg.type === "add_project") {
+      var addPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
+      var addAbs = path.resolve(addPath);
+      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
+        if (!ws._clayUser.linuxUser) {
+          sendTo(ws, { type: "add_project_result", ok: false, error: "No Linux user assigned" });
+          return;
+        }
+        var userHome = "/home/" + ws._clayUser.linuxUser;
+        if (addAbs !== userHome && (addAbs + "/").indexOf(userHome + "/") !== 0) {
+          sendTo(ws, { type: "add_project_result", ok: false, error: "Path not allowed. You can only add directories under " + userHome });
+          return;
+        }
+      }
+      try {
+        var addStat = fs.statSync(addAbs);
+        if (!addStat.isDirectory()) {
+          sendTo(ws, { type: "add_project_result", ok: false, error: "Not a directory" });
+          return;
+        }
+      } catch (e) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Directory not found" });
+        return;
+      }
+      if (typeof onAddProject === "function") {
+        var result = onAddProject(addAbs, ws._clayUser);
+        sendTo(ws, { type: "add_project_result", ok: result.ok, slug: result.slug, error: result.error, existing: result.existing });
+      } else {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
+      }
+      return;
+    }
+
+    // Permission gate shared by create_project and clone_project.
+    if (msg.type === "create_project" || msg.type === "clone_project") {
+      if (ws._clayUser && usersModule) {
+        var cpPerms = usersModule.getEffectivePermissions(ws._clayUser, osUsers);
+        if (!cpPerms.createProject) {
+          sendTo(ws, { type: "add_project_result", ok: false, error: "You do not have permission to create projects" });
+          return;
+        }
+      }
+    }
+
+    if (msg.type === "create_project") {
+      var createName = (msg.name || "").trim();
+      if (!createName || !/^[a-zA-Z0-9_-]+$/.test(createName)) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Invalid name. Use only letters, numbers, dashes, and underscores." });
+        return;
+      }
+      if (typeof onCreateProject === "function") {
+        var createResult = onCreateProject(createName, ws._clayUser);
+        sendTo(ws, { type: "add_project_result", ok: createResult.ok, slug: createResult.slug, error: createResult.error });
+      } else {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
+      }
+      return;
+    }
+
+    if (msg.type === "clone_project") {
+      var cloneUrl = (msg.url || "").trim();
+      if (!cloneUrl || (!/^https?:\/\//.test(cloneUrl) && !/^git@/.test(cloneUrl))) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Invalid URL. Use https:// or git@ format." });
+        return;
+      }
+      sendTo(ws, { type: "clone_project_progress", status: "cloning" });
+      if (typeof onCloneProject === "function") {
+        onCloneProject(cloneUrl, ws._clayUser, function (cloneResult) {
+          sendTo(ws, { type: "add_project_result", ok: cloneResult.ok, slug: cloneResult.slug, error: cloneResult.error });
+        });
+      } else {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
+      }
+      return;
+    }
+  }
+
+  function handleConnection(ws, wsUser) {
+    ws._clayUser = wsUser || null;
+    ws.on("message", function (data) {
+      var msg;
+      try { msg = JSON.parse(data); } catch (e) { return; }
+      handleMessage(ws, msg);
+    });
+  }
+
+  return {
+    handleConnection: handleConnection,
+    handleMessage: handleMessage,
+  };
+}
+
+module.exports = { attachGlobalWs: attachGlobalWs };

package/lib/server-settings.js

@@ -56,10 +56,10 @@ function attachSettings(ctx) {
         if (dc.terminalFont && typeof dc.terminalFont === "object") {
           profile.terminalFont = {
             family: dc.terminalFont.family || "'SF Mono', Menlo, Monaco, 'Courier New', monospace",
-            size: typeof dc.terminalFont.size === "number" ? dc.terminalFont.size : 13,
+            size: typeof dc.terminalFont.size === "number" ? dc.terminalFont.size : 14,
           };
         } else {
-          profile.terminalFont = { family: "'SF Mono', Menlo, Monaco, 'Courier New', monospace", size: 13 };
+          profile.terminalFont = { family: "'SF Mono', Menlo, Monaco, 'Courier New', monospace", size: 14 };
         }
       }
       // Check if custom avatar file exists

package/lib/server.js

@@ -18,6 +18,7 @@ var serverAdmin = require("./server-admin");
 var serverSettings = require("./server-settings");
 var serverPalette = require("./server-palette");
 var serverEmail = require("./server-email");
+var serverGlobalWs = require("./server-global-ws");
 
 var { CONFIG_DIR } = require("./config");
 var { provisionLinuxUser } = require("./os-users");
@@ -684,14 +685,23 @@ function createServer(opts) {
           return;
         }
       }
-      // No accessible projects — show info page
+      // No accessible projects. Users who can create one fall through to
+      // the regular app shell (index.html) — the slug-less /ws and the
+      // sidebar's + button take over from there. The static "ask an admin"
+      // page is only for multi-user users who genuinely can't do anything
+      // (no createProject permission and no projects shared with them).
       if (users.isMultiUser()) {
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(pages.noProjectsPageHtml());
-        return;
+        var rootUser = getMultiUserFromReq(req);
+        var rootPerms = rootUser ? users.getEffectivePermissions(rootUser, osUsers) : null;
+        if (!rootPerms || !rootPerms.createProject) {
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(pages.noProjectsPageHtml());
+          return;
+        }
       }
-      res.writeHead(200, { "Content-Type": "text/plain" });
-      res.end("No projects registered.");
+      if (serveStatic("/index.html", res)) return;
+      res.writeHead(500, { "Content-Type": "text/plain" });
+      res.end("App shell missing.");
       return;
     }
 
@@ -868,6 +878,18 @@ function createServer(opts) {
   // --- WebSocket ---
   var wss = new WebSocketServer({ noServer: true });
 
+  // Slug-less /ws handler: lets a user with no projects yet load the regular
+  // app shell and create/add/clone their first one. Only knows about the
+  // small set of bootstrap messages (browse_dir, add_project, create_project,
+  // clone_project, ping).
+  var globalWs = serverGlobalWs.attachGlobalWs({
+    osUsers: osUsers,
+    usersModule: users,
+    onAddProject: onAddProject,
+    onCreateProject: onCreateProject,
+    onCloneProject: onCloneProject,
+  });
+
   server.on("upgrade", function (req, socket, head) {
     // Origin validation (CSRF prevention)
     var origin = req.headers.origin;
@@ -907,7 +929,18 @@ function createServer(opts) {
     // Extract slug from WS URL: /p/{slug}/ws
     var wsSlug = extractSlug(req.url);
     if (!wsSlug) {
-      socket.destroy();
+      // Slug-less /ws: bootstrap channel for a client that hasn't entered
+      // any project yet (no projects exist, or none accessible to this user
+      // but they can still create one). Anything other than exactly /ws is
+      // rejected.
+      if (req.url !== "/ws") {
+        socket.destroy();
+        return;
+      }
+      var globalUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
+      wss.handleUpgrade(req, socket, head, function (ws) {
+        globalWs.handleConnection(ws, globalUser);
+      });
       return;
     }
 

package/lib/tui-transcript-index.js

@@ -0,0 +1,125 @@
+// tui-transcript-index.js
+//
+// Build a per-session index of assistant text messages from a Claude Code
+// TUI transcript (~/.claude/projects/{encoded-cwd}/{cliSessionId}.jsonl).
+//
+// The TUI message-grab feature uses this index on the client to map a
+// hovered xterm region back to its original markdown source. We only
+// extract assistant text blocks. Tool calls and tool results render in
+// the terminal in a shape that's quite different from their JSONL form,
+// so matching them would be noisy and not particularly useful.
+//
+// Codex sessions don't write transcripts at all; callers should skip
+// indexing for non-claude vendors.
+
+var fs = require("fs");
+var path = require("path");
+var utils = require("./utils");
+var { REAL_HOME } = require("./config");
+
+var encodeCwd = utils.encodeCwd;
+
+// Min length of a normalized assistant message to bother indexing.
+// Anything shorter ("ok", "sure", "yes") would generate too many false
+// positives when matched against a hovered terminal block.
+var MIN_MATCH_LEN = 20;
+
+function transcriptFilePath(cwd, cliSessionId) {
+  if (!cwd || !cliSessionId) return null;
+  return path.join(REAL_HOME, ".claude", "projects", encodeCwd(cwd), cliSessionId + ".jsonl");
+}
+
+// matchKey is just whitespace-normalized raw markdown. We intentionally
+// do NOT strip markdown decoration here.
+//
+// Reasoning: TUI rendering drops markdown markers (**bold** -> bold,
+// `code` -> code, [text](url) -> text, etc.) and the visible text is
+// therefore always a substring of the JSONL source's character stream.
+// If we strip server-side we risk getting the rules wrong on corner
+// cases (double-backtick code spans, list-bullet rendering quirks,
+// nested formatting) and the resulting matchKey diverges from both
+// sides at once. Leaving the source alone and letting the client do a
+// multi-offset substring probe against block text is more robust and
+// much less code.
+function normalizeForMatch(s) {
+  if (!s) return "";
+  return s.replace(/\s+/g, " ").trim();
+}
+
+// Stable per-message id. Claude's JSONL usually carries one of these but
+// fall back to the parsed line index so the client always has a handle.
+function messageId(obj, index) {
+  if (obj && obj.uuid) return String(obj.uuid);
+  if (obj && obj.message && obj.message.id) return String(obj.message.id);
+  return "msg-" + index;
+}
+
+// Parse a single JSONL line into one assistant-text record, or null
+// when the line isn't one we index (user prompts, tool_use blocks,
+// tool_result records, etc.). Text-only assistant blocks get joined
+// in order so a multi-block response surfaces as a single grabbable
+// message.
+function parseAssistantTextLine(line, index) {
+  var obj;
+  try { obj = JSON.parse(line); } catch (e) { return null; }
+  if (!obj || !obj.message) return null;
+  if (obj.message.role !== "assistant") return null;
+  if (!Array.isArray(obj.message.content)) return null;
+
+  var text = "";
+  for (var i = 0; i < obj.message.content.length; i++) {
+    var block = obj.message.content[i];
+    if (block && block.type === "text" && typeof block.text === "string") {
+      text += block.text;
+    }
+  }
+  text = text.trim();
+  if (!text) return null;
+
+  var normalized = normalizeForMatch(text);
+  if (normalized.length < MIN_MATCH_LEN) return null;
+
+  return {
+    id: messageId(obj, index),
+    text: text,
+    matchKey: normalized,
+  };
+}
+
+// Read the whole transcript and return the assistant text index. The
+// transcripts are small enough (KB to a few MB) that a sync read on
+// session open or on a watcher-driven update is fine. We also return
+// the mtime/size so callers can short-circuit re-reads when nothing
+// changed.
+function readAssistantIndex(cwd, cliSessionId) {
+  var file = transcriptFilePath(cwd, cliSessionId);
+  if (!file) return { messages: [], mtimeMs: 0, byteLength: 0 };
+  var raw;
+  var stat;
+  try {
+    raw = fs.readFileSync(file, "utf8");
+    stat = fs.statSync(file);
+  } catch (e) {
+    return { messages: [], mtimeMs: 0, byteLength: 0 };
+  }
+  var lines = raw.split("\n");
+  var messages = [];
+  for (var i = 0; i < lines.length; i++) {
+    if (!lines[i]) continue;
+    var entry = parseAssistantTextLine(lines[i], i);
+    if (entry) messages.push(entry);
+  }
+  return {
+    messages: messages,
+    mtimeMs: stat.mtimeMs || 0,
+    byteLength: stat.size || raw.length,
+  };
+}
+
+module.exports = {
+  MIN_MATCH_LEN: MIN_MATCH_LEN,
+  transcriptFilePath: transcriptFilePath,
+  readAssistantIndex: readAssistantIndex,
+  parseAssistantTextLine: parseAssistantTextLine,
+  normalizeForMatch: normalizeForMatch,
+};

package/lib/users-preferences.js

@@ -412,7 +412,7 @@ function attachPreferences(deps) {
   // single object so the two values stay together.
 
   var DEFAULT_TERM_FONT_FAMILY = "'SF Mono', Menlo, Monaco, 'Courier New', monospace";
-  var DEFAULT_TERM_FONT_SIZE = 13;
+  var DEFAULT_TERM_FONT_SIZE = 14;
   var MIN_TERM_FONT_SIZE = 9;
   var MAX_TERM_FONT_SIZE = 32;
 

package/lib/ws-schema.js

@@ -31,6 +31,7 @@ var schema = {
   "load_more_history":        { direction: "c2s", handler: "lib/project-sessions.js", description: "Request older history entries for the current session" },
   "fork_session":             { direction: "c2s", handler: "lib/project-sessions.js", description: "Fork a session from a given message UUID" },
   "input_sync":               { direction: "c2s", handler: "lib/project-sessions.js", description: "Sync the current input field text to other clients" },
+  "tui_transcript_request":   { direction: "c2s", handler: "lib/project-sessions.js", description: "Ask for the assistant text index of a Claude TUI session (for hover-to-grab)" },
 
   "session_list":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sessions for the sidebar" },
   "session_switched":         { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Confirmation that active session changed" },
@@ -42,6 +43,7 @@ var schema = {
   "search_content_results":   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full-text content search results" },
   "fork_complete":            { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Fork succeeded, includes new session ID" },
   "input_sync_broadcast":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Broadcast input text from another client" },
+  "tui_transcript_state":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Assistant text index for a Claude TUI session (full replace; sent on request and after each new assistant message)" },
 
   // -----------------------------------------------------------------------
   // History replay

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.40.1-beta.1",
+  "version": "2.41.0",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",