clay-server 4.0.0 → 4.1.0-beta.1

package/lib/sdk-bridge.js

@@ -627,8 +627,18 @@ function createSDKBridge(opts) {
     var PAIR_MCP_PREFIX = "mcp__clay-sessions__";
     var pairMcpTools = {
       propose_worker: true,
+      inspect_worker_proposal: true,
+      cancel_worker_proposal: true,
+      worker_runtime_catalog: true,
       send_to_partner: true,
       read_partner: true,
+      message_partner: true,
+      queue_partner_followup: true,
+      inspect_partner_followups: true,
+      cancel_partner_followup: true,
+      replace_partner_task: true,
+      resume_partner_task: true,
+      report_partner_outcome: true,
       partner_status: true,
       replace_partner: true,
       interrupt_partner: true,
@@ -638,6 +648,16 @@ function createSDKBridge(opts) {
     };
     var pairDynamicTools = {
       propose_worker: true,
+      inspect_worker_proposal: true,
+      cancel_worker_proposal: true,
+      worker_runtime_catalog: true,
+      message_partner: true,
+      queue_partner_followup: true,
+      inspect_partner_followups: true,
+      cancel_partner_followup: true,
+      replace_partner_task: true,
+      resume_partner_task: true,
+      report_partner_outcome: true,
       partner_status: true,
       replace_partner: true,
       interrupt_partner: true,
@@ -866,7 +886,7 @@ function createSDKBridge(opts) {
       }
 
       var _nm = getNotificationsModule();
-      if (_nm) {
+      if (_nm && session.homeClayEntryMode !== "search") {
         _nm.notify("permission_request", {
           title: permissionPushTitle(toolName, input),
           body: permissionPushBody(toolName, input),

package/lib/server-admin.js

@@ -632,9 +632,9 @@ function attachAdmin(ctx) {
         return true;
       }
       var projSlug = fullUrl.split("/")[4];
-      if (projSlug.indexOf("--") !== -1) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end('{"error":"Worktree projects inherit parent settings"}');
+      if (!projects.get(projSlug)) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end('{"error":"Project not found"}');
         return true;
       }
       var body = "";

package/lib/server-global-ws.js

@@ -40,6 +40,8 @@ function attachGlobalWs(opts) {
   var onCloneProject = opts.onCloneProject;
   var onHomePreferenceMessage = opts.onHomePreferenceMessage;
   var onAppMessage = opts.onAppMessage;
+  var onConnection = opts.onConnection;
+  var clients = new Set();
 
   function handleMessage(ws, msg) {
     if (!msg || typeof msg !== "object") return;
@@ -184,16 +186,24 @@ function attachGlobalWs(opts) {
 
   function handleConnection(ws, wsUser) {
     ws._clayUser = wsUser || null;
+    clients.add(ws);
+    ws.on("close", function () { clients.delete(ws); });
     ws.on("message", function (data) {
       var msg;
       try { msg = JSON.parse(data); } catch (e) { return; }
       handleMessage(ws, msg);
     });
+    if (typeof onConnection === "function") onConnection(ws);
+  }
+
+  function forEachClient(visitor) {
+    clients.forEach(function (ws) { visitor(ws); });
   }
 
   return {
     handleConnection: handleConnection,
     handleMessage: handleMessage,
+    forEachClient: forEachClient,
   };
 }
 

package/lib/server-home-chat-events.js

@@ -267,6 +267,9 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
     }
     if (event.type === "tool_executing") return Object.assign({ type: "home_clay_activity", activityId: session._homeClayToolActivityId || "tool:" + (session._homeClayActivityStep || 1), phase: "searching", status: "active", label: searchToolLabel(event.name, event.input), step: session._homeClayActivityStep || 1 }, metadata);
     if (event.type === "tool_result") return Object.assign({ type: "home_clay_activity", activityId: session._homeClayToolActivityId || "tool:" + (session._homeClayActivityStep || 1), phase: event.is_error ? "reconsidering" : "reviewing", status: event.is_error ? "error" : "done", label: event.is_error ? "That lead did not work; trying another route" : "Reviewed the search results", step: session._homeClayActivityStep || 1 }, metadata);
+    if (event.type === "permission_request") return Object.assign({ type: "home_mate_permission_request", permissionRequestId: event.requestId, toolName: event.toolName, toolInput: event.toolInput, decisionReason: event.decisionReason || "" }, metadata);
+    if (event.type === "permission_resolved") return Object.assign({ type: "home_mate_permission_resolved", permissionRequestId: event.requestId, decision: event.decision || "deny" }, metadata);
+    if (event.type === "permission_cancel") return Object.assign({ type: "home_mate_permission_cancelled", permissionRequestId: event.requestId }, metadata);
   }
   if (session && session.homeDebatePlanning === true && HOME_DEBATE_EVENT_TYPES[event.type]) {
     var live = { type: "home_debate_event", eventType: event.type };

package/lib/server-home-chat.js

@@ -224,6 +224,12 @@ function attachHomeChat(deps) {
         messages: historyToHomeChat(session.history || [], session.debateSetupMode === true, session.mateCreationMode === true),
         isProcessing: session.isProcessing === true,
       };
+      if (session.homeClayEntryMode === "search") {
+        payload.pendingPermissions = Object.keys(session.pendingPermissions || {}).map(function (permissionRequestId) {
+          var pending = session.pendingPermissions[permissionRequestId];
+          return { permissionRequestId: permissionRequestId, toolName: pending.toolName, toolInput: pending.toolInput, decisionReason: pending.decisionReason || "" };
+        });
+      }
       if (session.debateSetupMode === true) payload.debatePlanning = true;
       if (session.homeDebatePhase) payload.debatePhase = session.homeDebatePhase;
       if (session.mateCreationMode === true) payload.mateCreation = true;
@@ -388,6 +394,35 @@ function attachHomeChat(deps) {
 
   function handleMessage(ws, msg) {
     if (!msg || typeof msg.type !== "string") return false;
+    if (msg.type === "home_mate_stop" || msg.type === "home_mate_permission_response") {
+      var controlUserId = ws._clayUser ? ws._clayUser.id : null;
+      if (users.isMultiUser() && !controlUserId) {
+        sendError(ws, msg.mateId || null, "Not authenticated.", msg.requestId || null, msg.sessionId || null);
+        return true;
+      }
+      var controlFound = findMateProject(controlUserId, msg.mateId, true);
+      var controlTap = messageTap(ws, msg);
+      var controlManager = controlFound ? controlFound.ctx.getSessionManager() : null;
+      var controlSession = controlManager && controlTap && controlTap.mateId === controlFound.mate.id && controlTap.requestId === msg.requestId
+        ? controlManager.sessions.get(controlTap.sessionId) : null;
+      var controlReference = controlSession ? sessionReference(controlSession) : null;
+      if (!controlFound || !controlSession || controlReference !== msg.sessionId || !ownsSession(controlSession, controlUserId) || controlSession.homeClayEntryMode !== "search") {
+        sendError(ws, msg.mateId || null, "Conversation control is no longer available.", msg.requestId || null, msg.sessionId || null, "session_not_found");
+        return true;
+      }
+      if (msg.type === "home_mate_permission_response") {
+        var controlDecision = msg.decision === "allow" ? "allow" : (msg.decision === "deny" ? "deny" : null);
+        if (!controlDecision || typeof msg.permissionRequestId !== "string" || !controlSession.pendingPermissions[msg.permissionRequestId]) {
+          sendError(ws, controlFound.mate.id, "This permission request is no longer pending.", msg.requestId || null, msg.sessionId || null, "permission_not_found", { toolId: msg.permissionRequestId });
+          return true;
+        }
+        controlFound.ctx.handleHomePermissionResponse(ws, { requestId: msg.permissionRequestId, decision: controlDecision }, controlSession);
+      } else {
+        sendMessage(ws, { type: "home_mate_stopping", mateId: controlFound.mate.id, sessionId: controlReference, requestId: msg.requestId || null });
+        controlFound.ctx.stopHomeSession(controlSession);
+      }
+      return true;
+    }
     if (msg.type !== "home_debates_list" && msg.type !== "home_clay_ask" && msg.type !== "home_clay_session_resolve" && msg.type !== "home_clay_log_resolve" && msg.type !== "home_mate_present" && msg.type !== "home_mate_open" && msg.type !== "home_mate_sessions_list" && msg.type !== "home_mate_session_open" && msg.type !== "home_mate_send" && msg.type !== "home_mate_new_session" && msg.type !== "home_mate_debate_plan" && msg.type !== "home_debate_proposal_response" && msg.type !== "home_debate_question_response" && msg.type !== "home_debate_control" && msg.type !== "home_mate_creation_plan" && msg.type !== "home_mate_creation_question_response" && msg.type !== "home_mate_creation_proposal_response" && msg.type !== "home_mate_close" && msg.type !== "home_mate_memory_list" && msg.type !== "home_mate_knowledge_list" && msg.type !== "home_mate_models_get" && msg.type !== "home_mate_model_set") {
       return false;
     }

package/lib/server-mates.js

@@ -20,11 +20,12 @@ function attachMates(ctx) {
       var projList = [];
       projects.forEach(function (pCtx, pSlug) {
         var st = pCtx.getStatus();
-        if (st.isMate || st.isWorktree) return;
+        if (st.isMate) return;
         // Filter by user access in multi-user mode
-        if (userId && users.isMultiUser() && onGetProjectAccess) {
+        if (users.isMultiUser() && onGetProjectAccess) {
+          if (!userId) return;
           var access = onGetProjectAccess(pSlug);
-          if (access && !access.error && !users.canAccessProject(userId, access)) return;
+          if (!access || access.error || !users.canAccessProject(userId, access)) return;
         }
         projList.push(st);
       });

package/lib/server-palette.js

@@ -5,6 +5,17 @@ function attachPalette(ctx) {
   var projects = ctx.projects;
   var getMultiUserFromReq = ctx.getMultiUserFromReq;
   var onGetProjectAccess = ctx.onGetProjectAccess;
+  var canUserAccessSlug = ctx.canUserAccessSlug;
+
+  function accessFor(user, slug, status) {
+    if (!user) return { visibility: "public" };
+    if (typeof canUserAccessSlug !== "function" || !canUserAccessSlug(user.id, slug)) return null;
+    if (status && status.isMate) {
+      return { visibility: "private", ownerId: status.projectOwnerId || null, allowedUsers: [] };
+    }
+    var access = onGetProjectAccess ? onGetProjectAccess(slug) : null;
+    return access && !access.error ? access : null;
+  }
 
   function handleRequest(req, res, fullUrl) {
     if (req.method !== "GET" || fullUrl !== "/api/palette/search") return false;
@@ -26,17 +37,13 @@ function attachPalette(ctx) {
       // Recent mode: return all sessions sorted by lastActivity
       projects.forEach(function (pCtx, pSlug) {
         var status = pCtx.getStatus();
-        if (status.isWorktree) return;
-        if (paletteUser && onGetProjectAccess) {
-          var pAccess = onGetProjectAccess(pSlug);
-          if (pAccess && !pAccess.error && !users.canAccessProject(paletteUser.id, pAccess)) return;
-        }
+        var pAccess = accessFor(paletteUser, pSlug, status);
+        if (paletteUser && !pAccess) return;
         pCtx.sm.sessions.forEach(function (session) {
           if (session.hidden) return;
           if (paletteUser) {
             if (users.isMultiUser()) {
-              var sAccess = onGetProjectAccess ? onGetProjectAccess(pSlug) : null;
-              if (!users.canAccessSession(paletteUser.id, session, sAccess)) return;
+              if (!users.canAccessSession(paletteUser.id, session, pAccess)) return;
             }
           } else {
             if (session.ownerId) return;
@@ -65,18 +72,14 @@ function attachPalette(ctx) {
       var projectSessions = [];
       projects.forEach(function (pCtx, pSlug) {
         var status = pCtx.getStatus();
-        if (status.isWorktree) return;
-        if (paletteUser && onGetProjectAccess) {
-          var pAccess = onGetProjectAccess(pSlug);
-          if (pAccess && !pAccess.error && !users.canAccessProject(paletteUser.id, pAccess)) return;
-        }
+        var pAccess = accessFor(paletteUser, pSlug, status);
+        if (paletteUser && !pAccess) return;
         var accessibleSessions = [];
         pCtx.sm.sessions.forEach(function (session) {
           if (session.hidden) return;
           if (paletteUser) {
             if (users.isMultiUser()) {
-              var sAccess = onGetProjectAccess ? onGetProjectAccess(pSlug) : null;
-              if (!users.canAccessSession(paletteUser.id, session, sAccess)) return;
+              if (!users.canAccessSession(paletteUser.id, session, pAccess)) return;
             }
           } else {
             if (session.ownerId) return;

package/lib/server.js

@@ -202,6 +202,23 @@ function createServer(opts) {
   var isRequestAuthed = auth.isRequestAuthed;
   var parseCookies = auth.parseCookies;
 
+  function canUserAccessSlug(userId, slug) {
+    if (!userId || !slug) return false;
+    var project = projects && projects.get(slug);
+    var status = project && project.getStatus ? project.getStatus() : null;
+    if (status && status.isMate === true) {
+      return users.canAccessProject(userId, {
+        visibility: "private",
+        ownerId: status.projectOwnerId || null,
+        allowedUsers: [],
+      }) === true;
+    }
+    if (!onGetProjectAccess) return false;
+    var access = onGetProjectAccess(slug);
+    if (!access || access.error) return false;
+    return users.canAccessProject(userId, access) === true;
+  }
+
   var realVersion = require("../package.json").version;
   var currentVersion = debug ? "0.0.9" : realVersion;
 
@@ -339,6 +356,13 @@ function createServer(opts) {
       if (!access || access.error) return false;
       return users.canAccessProject(userId, access) === true;
     },
+    hasFullProjectAccess: function (userId, status) {
+      if (!status || !status.slug || !onGetProjectAccess) return false;
+      var access = onGetProjectAccess(status.slug);
+      if (!access || access.error) return false;
+      var governing = access.isWorktree && access.parentAccess ? access.parentAccess : access;
+      return users.canAccessProject(userId, governing) === true;
+    },
     resolveMate: function (userId, mateId) {
       return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
     },
@@ -403,6 +427,7 @@ function createServer(opts) {
     projects: projects,
     getMultiUserFromReq: getMultiUserFromReq,
     onGetProjectAccess: onGetProjectAccess,
+    canUserAccessSlug: canUserAccessSlug,
   });
 
   // --- Push module (global) ---
@@ -662,7 +687,11 @@ function createServer(opts) {
       if (isRequestAuthed(req)) {
         var mem = process.memoryUsage();
         var activeSessions = 0;
-        projects.forEach(function (ctx) {
+        var healthProjects = 0;
+        var healthUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
+        projects.forEach(function (ctx, slug) {
+          if (users.isMultiUser() && (!healthUser || !canUserAccessSlug(healthUser.id, slug))) return;
+          healthProjects++;
           if (ctx && ctx.clients) {
             activeSessions += ctx.clients.size || 0;
           }
@@ -671,7 +700,7 @@ function createServer(opts) {
         health.version = pkg.version;
         health.node = process.version;
         health.sessions = activeSessions;
-        health.projects = projects.size;
+        health.projects = healthProjects;
         health.memory = {
           rss: mem.rss,
           heapUsed: mem.heapUsed,
@@ -850,7 +879,9 @@ function createServer(opts) {
         return;
       }
       var projectList = [];
+      var infoUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
       projects.forEach(function (ctx, slug) {
+        if (users.isMultiUser() && (!infoUser || !canUserAccessSlug(infoUser.id, slug))) return;
         projectList.push({ slug: slug, project: ctx.project });
       });
       res.writeHead(200, { "Content-Type": "application/json" });
@@ -912,15 +943,12 @@ function createServer(opts) {
     res.setHeader("Set-Cookie", "clay_last_project=" + slug + "; Path=/; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : ""));
 
     // Multi-user: check project access for HTTP requests
-    if (users.isMultiUser() && onGetProjectAccess) {
+    if (users.isMultiUser()) {
       var httpUser = getMultiUserFromReq(req);
-      if (httpUser) {
-        var httpAccess = onGetProjectAccess(slug);
-        if (httpAccess && !httpAccess.error && !users.canAccessProject(httpUser.id, httpAccess)) {
-          res.writeHead(302, { "Location": "/" });
-          res.end();
-          return;
-        }
+      if (!httpUser || !canUserAccessSlug(httpUser.id, slug)) {
+        res.writeHead(302, { "Location": "/" });
+        res.end();
+        return;
       }
     }
 
@@ -1029,6 +1057,9 @@ function createServer(opts) {
     onAppMessage: function (ws, msg) {
       return handleDmMessage(ws, msg);
     },
+    onConnection: function (ws) {
+      sendProjectsUpdatedToClient(ws);
+    },
   });
 
   server.on("upgrade", function (req, socket, head) {
@@ -1106,19 +1137,19 @@ function createServer(opts) {
     if (users.isMultiUser()) {
       wsUser = getMultiUserFromReq(req);
       // Check project access for multi-user mode
-      if (wsUser && onGetProjectAccess) {
-        // For worktree projects, inherit access from parent
-        var accessSlug = (wsSlug.indexOf("--") !== -1) ? wsSlug.split("--")[0] : wsSlug;
-        var projectAccess = onGetProjectAccess(accessSlug);
+      if (wsUser) {
+        var projectAccess = onGetProjectAccess ? onGetProjectAccess(wsSlug) : null;
         if (debug) console.log("[server] WS access check:", wsSlug, "user:", wsUser.id, "role:", wsUser.role, "visibility:", projectAccess && projectAccess.visibility, "ownerId:", projectAccess && projectAccess.ownerId, "allowed:", projectAccess && projectAccess.allowedUsers);
-        if (projectAccess && !projectAccess.error) {
-          if (!users.canAccessProject(wsUser.id, projectAccess)) {
-            if (debug) console.log("[server] WS rejected: access denied for", wsUser.id, "on", wsSlug);
-            socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
-            socket.destroy();
-            return;
-          }
+        if (!canUserAccessSlug(wsUser.id, wsSlug)) {
+          if (debug) console.log("[server] WS rejected: access denied for", wsUser.id, "on", wsSlug);
+          socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+          socket.destroy();
+          return;
         }
+      } else {
+        socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+        socket.destroy();
+        return;
       }
     }
 
@@ -1200,13 +1231,9 @@ function createServer(opts) {
           var filtered = allProjectsList;
           if (users.isMultiUser() && onGetProjectAccess) {
             var wsUser = ws._clayUser;
-            if (wsUser) {
-              filtered = allProjectsList.filter(function (p) {
-                var access = onGetProjectAccess(p.slug);
-                if (!access || access.error) return true;
-                return users.canAccessProject(wsUser.id, access);
-              });
-            }
+            filtered = wsUser ? allProjectsList.filter(function (p) {
+              return canUserAccessSlug(wsUser.id, p.slug);
+            }) : [];
           }
           // Attach per-project unread counts for this client
           var unreadMap = getCrossProjectUnread(ws);
@@ -1306,20 +1333,12 @@ function createServer(opts) {
       authToken: pinHash || null,
       getProjectCount: function () { return projects.size; },
       getProjectList: function (userId) {
-        var list = [];
-        projects.forEach(function (ctx, s) {
-          var status = ctx.getStatus();
-          if (userId && users.isMultiUser() && onGetProjectAccess) {
-            var access = onGetProjectAccess(s);
-            if (access && !access.error && !users.canAccessProject(userId, access)) return;
-          }
-          list.push(status);
-        });
-        return list;
+        return getVisibleProjects(userId);
       },
-      getHubSchedules: function () {
+      getHubSchedules: function (userId) {
         var allSchedules = [];
         projects.forEach(function (ctx, s) {
+          if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, s))) return;
           var status = ctx.getStatus();
           var recs = ctx.getSchedules();
           for (var i = 0; i < recs.length; i++) {
@@ -1379,6 +1398,7 @@ function createServer(opts) {
         if (!ctx) return 0;
         return ctx.getSchedules().length;
       },
+      canAccessProjectSlug: canUserAccessSlug,
       onPresenceChange: broadcastPresenceChange,
       onProcessingChanged: broadcastProcessingChange,
       onSessionDone: function () { onSessionDone(slug); },
@@ -1592,27 +1612,81 @@ function createServer(opts) {
   function getServerUsers() {
     var seen = {};
     var list = [];
-    projects.forEach(function (ctx) {
-      ctx.forEachClient(function (ws) {
-        if (!ws._clayUser) return;
-        var u = ws._clayUser;
-        if (seen[u.id]) return;
-        seen[u.id] = true;
-        var p = u.profile || {};
-        list.push({
-          id: u.id,
-          displayName: p.name || u.displayName || u.username,
-          username: u.username,
-          avatarStyle: p.avatarStyle || "imprint",
-          avatarSeed: p.avatarSeed || u.username,
-          avatarColor: p.avatarColor || "#5857fc",
-          avatarCustom: p.avatarCustom || "",
-        });
+    forEachAppClient(function (ws) {
+      if (!ws._clayUser) return;
+      var u = ws._clayUser;
+      if (seen[u.id]) return;
+      seen[u.id] = true;
+      var p = u.profile || {};
+      list.push({
+        id: u.id,
+        displayName: p.name || u.displayName || u.username,
+        username: u.username,
+        avatarStyle: p.avatarStyle || "imprint",
+        avatarSeed: p.avatarSeed || u.username,
+        avatarColor: p.avatarColor || "#5857fc",
+        avatarCustom: p.avatarCustom || "",
       });
     });
     return list;
   }
 
+  function forEachAppClient(visitor) {
+    if (globalWs && typeof globalWs.forEachClient === "function") {
+      globalWs.forEachClient(visitor);
+    }
+    projects.forEach(function (ctx) {
+      ctx.forEachClient(visitor);
+    });
+  }
+
+  function getVisibleProjects(userId) {
+    var visible = [];
+    projects.forEach(function (ctx, slug) {
+      if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, slug))) return;
+      visible.push(ctx.getStatus());
+    });
+    return visible;
+  }
+
+  function sendProjectsUpdatedToClient(ws, serverUsers, allUsers) {
+    if (!ws || ws.readyState !== 1) return;
+    var userId = ws._clayUser ? ws._clayUser.id : null;
+    var visibleProjects = getVisibleProjects(userId);
+    var message = {
+      type: "projects_updated",
+      projects: visibleProjects,
+      projectCount: visibleProjects.length,
+      removedProjects: getRemovedProjects(userId),
+    };
+    if (users.isMultiUser()) {
+      message.serverUsers = serverUsers || getServerUsers();
+      message.allUsers = allUsers || users.getAllUsers().map(function (user) {
+        var profile = user.profile || {};
+        return {
+          id: user.id,
+          displayName: profile.name || user.displayName || user.username,
+          username: user.username,
+          role: user.role,
+          avatarStyle: profile.avatarStyle || "imprint",
+          avatarSeed: profile.avatarSeed || user.username,
+          avatarColor: profile.avatarColor || "#5857fc",
+          avatarCustom: profile.avatarCustom || "",
+        };
+      });
+      message.dmFavorites = userId ? users.getDmFavorites(userId) : [];
+      message.dmConversations = [];
+      if (userId) {
+        var hidden = users.getDmHidden(userId);
+        var dmList = dm.getDmList(userId);
+        for (var i = 0; i < dmList.length; i++) {
+          if (hidden.indexOf(dmList[i].otherUserId) === -1) message.dmConversations.push(dmList[i].otherUserId);
+        }
+      }
+    }
+    ws.send(JSON.stringify(message));
+  }
+
   // Debounced broadcast of projects_updated when presence changes
   // Sends per-user filtered project lists + server-wide user list
   var presenceTimer = null;
@@ -1621,12 +1695,7 @@ function createServer(opts) {
     presenceTimer = setTimeout(function () {
       presenceTimer = null;
       if (!users.isMultiUser()) {
-        broadcastAll({
-          type: "projects_updated",
-          projects: getProjects(),
-          projectCount: projects.size,
-          removedProjects: getRemovedProjects(),
-        });
+        forEachAppClient(function (ws) { sendProjectsUpdatedToClient(ws); });
         return;
       }
       var serverUsers = getServerUsers();
@@ -1643,61 +1712,73 @@ function createServer(opts) {
           avatarCustom: p.avatarCustom || "",
         };
       });
-      // Build per-user filtered lists, send individually
+      // Build per-user filtered lists, send individually to both project and
+      // slug-less Home sockets. A Home fallback must replace, never retain,
+      // the project cache from its previous authenticated project socket.
       var sentUsers = {};
-      projects.forEach(function (ctx) {
-        ctx.forEachClient(function (ws) {
-          var userId = ws._clayUser ? ws._clayUser.id : null;
-          var key = userId || "__anon__";
-          if (sentUsers[key]) {
-            // Already computed for this user, just send the cached msg
-            ws.send(sentUsers[key]);
-            return;
-          }
-          var filteredProjects = [];
-          projects.forEach(function (pCtx, s) {
-            var status = pCtx.getStatus();
-            if (userId && onGetProjectAccess) {
-              var access = onGetProjectAccess(s);
-              if (access && !access.error && !users.canAccessProject(userId, access)) return;
-            }
-            filteredProjects.push(status);
-          });
-          // Per-user DM data
-          var userDmFavorites = userId ? users.getDmFavorites(userId) : [];
-          var userDmHidden = userId ? users.getDmHidden(userId) : [];
-          var userDmConversations = [];
-          if (userId) {
-            var dmList = dm.getDmList(userId);
-            for (var di = 0; di < dmList.length; di++) {
-              if (userDmHidden.indexOf(dmList[di].otherUserId) === -1) {
-                userDmConversations.push(dmList[di].otherUserId);
-              }
+      forEachAppClient(function (ws) {
+        var userId = ws._clayUser ? ws._clayUser.id : null;
+        var key = userId || "__anon__";
+        if (sentUsers[key]) {
+          // Already computed for this user, just send the cached msg
+          if (ws.readyState === 1) ws.send(sentUsers[key]);
+          return;
+        }
+        var filteredProjects = getVisibleProjects(userId);
+        // Per-user DM data
+        var userDmFavorites = userId ? users.getDmFavorites(userId) : [];
+        var userDmHidden = userId ? users.getDmHidden(userId) : [];
+        var userDmConversations = [];
+        if (userId) {
+          var dmList = dm.getDmList(userId);
+          for (var di = 0; di < dmList.length; di++) {
+            if (userDmHidden.indexOf(dmList[di].otherUserId) === -1) {
+              userDmConversations.push(dmList[di].otherUserId);
             }
           }
-          var msgStr = JSON.stringify({
-            type: "projects_updated",
-            projects: filteredProjects,
-            projectCount: projects.size,
-            serverUsers: serverUsers,
-            allUsers: allUsers,
-            dmFavorites: userDmFavorites,
-            dmConversations: userDmConversations,
-            removedProjects: getRemovedProjects(userId),
-          });
-          sentUsers[key] = msgStr;
-          ws.send(msgStr);
+        }
+        var msgStr = JSON.stringify({
+          type: "projects_updated",
+          projects: filteredProjects,
+          projectCount: filteredProjects.length,
+          serverUsers: serverUsers,
+          allUsers: allUsers,
+          dmFavorites: userDmFavorites,
+          dmConversations: userDmConversations,
+          removedProjects: getRemovedProjects(userId),
         });
+        sentUsers[key] = msgStr;
+        if (ws.readyState === 1) ws.send(msgStr);
       });
     }, 300);
   }
 
   function broadcastAll(msg) {
+    if (msg && msg.type === "projects_updated") {
+      broadcastPresenceChange();
+      return;
+    }
     projects.forEach(function (ctx) {
       ctx.send(msg);
     });
   }
 
+  function refreshProjectAccess() {
+    if (!users.isMultiUser()) return;
+    projects.forEach(function (ctx, slug) {
+      if (!ctx || typeof ctx.forEachClient !== "function") return;
+      ctx.forEachClient(function (ws) {
+        var userId = ws._clayUser && ws._clayUser.id;
+        if (userId && canUserAccessSlug(userId, slug)) return;
+        try {
+          if (ws.readyState === 1) ws.send(JSON.stringify({ type: "access_revoked", slug: slug }));
+          ws.close(1008, "Project access revoked");
+        } catch (e) {}
+      });
+    });
+    broadcastPresenceChange();
+  }
+
   // Send a message to every live ws belonging to a specific user across all projects.
   // Used by user-targeted notifications (e.g. user-to-user @mentions).
   function sendToUser(userId, msg) {
@@ -1813,6 +1894,7 @@ function createServer(opts) {
     setRecovery: auth.setRecovery,
     clearRecovery: auth.clearRecovery,
     broadcastAll: broadcastAll,
+    refreshProjectAccess: refreshProjectAccess,
     forEachProject: forEachProject,
     destroyProject: removeProject,
     destroyAll: destroyAll,