clay-server 4.0.1-beta.1 → 4.1.0-beta.1

package/lib/daemon-project-access.js

@@ -0,0 +1,118 @@
+// Persisted Clay-level access rules for parent projects and exact worktrees.
+// Filesystem and Git permissions are deliberately outside this module.
+
+function parentSlugFor(slug) {
+  if (typeof slug !== "string") return null;
+  var marker = slug.indexOf("--");
+  return marker > 0 ? slug.substring(0, marker) : null;
+}
+
+function findProject(config, slug) {
+  var projects = config && Array.isArray(config.projects) ? config.projects : [];
+  for (var i = 0; i < projects.length; i++) {
+    if (projects[i].slug === slug) return projects[i];
+  }
+  return null;
+}
+
+function uniqueUsers(values) {
+  var source = Array.isArray(values) ? values : [];
+  var seen = {};
+  var out = [];
+  for (var i = 0; i < source.length; i++) {
+    if (typeof source[i] !== "string" || !source[i] || seen[source[i]]) continue;
+    seen[source[i]] = true;
+    out.push(source[i]);
+  }
+  return out;
+}
+
+function getProjectAccess(config, slug, osUsers) {
+  var parentSlug = parentSlugFor(slug);
+  var project = findProject(config, parentSlug || slug);
+  if (!project) return { error: "Project not found" };
+
+  var isMateProject = project.slug.indexOf("mate-") === 0;
+  var visibility = isMateProject ? "private" : (project.visibility || (osUsers ? "private" : "public"));
+  var parentAllowedUsers = uniqueUsers(project.allowedUsers);
+  if (!parentSlug) {
+    return {
+      slug: slug,
+      visibility: visibility,
+      allowedUsers: parentAllowedUsers,
+      ownerId: project.ownerId || null,
+      isWorktree: false,
+    };
+  }
+
+  var grants = project.worktreeAllowedUsers && project.worktreeAllowedUsers[slug];
+  var worktreeAllowedUsers = uniqueUsers(grants);
+  return {
+    slug: slug,
+    visibility: visibility,
+    allowedUsers: uniqueUsers(parentAllowedUsers.concat(worktreeAllowedUsers)),
+    ownerId: project.ownerId || null,
+    isWorktree: true,
+    parentSlug: parentSlug,
+    parentAllowedUsers: parentAllowedUsers,
+    worktreeAllowedUsers: worktreeAllowedUsers,
+    parentAccess: {
+      slug: parentSlug,
+      visibility: visibility,
+      allowedUsers: parentAllowedUsers,
+      ownerId: project.ownerId || null,
+    },
+  };
+}
+
+function setAllowedUsers(config, slug, allowedUsers) {
+  var parentSlug = parentSlugFor(slug);
+  var project = findProject(config, parentSlug || slug);
+  if (!project) return { error: "Project not found" };
+  var clean = uniqueUsers(allowedUsers);
+  if (!parentSlug) {
+    project.allowedUsers = clean;
+    return { ok: true, isWorktree: false, allowedUsers: clean };
+  }
+
+  if (!project.worktreeAllowedUsers || typeof project.worktreeAllowedUsers !== "object" || Array.isArray(project.worktreeAllowedUsers)) {
+    project.worktreeAllowedUsers = {};
+  }
+  if (clean.length > 0) project.worktreeAllowedUsers[slug] = clean;
+  else delete project.worktreeAllowedUsers[slug];
+  if (Object.keys(project.worktreeAllowedUsers).length === 0) delete project.worktreeAllowedUsers;
+  return { ok: true, isWorktree: true, allowedUsers: clean };
+}
+
+function clearWorktreeGrant(config, slug) {
+  var parentSlug = parentSlugFor(slug);
+  var project = parentSlug ? findProject(config, parentSlug) : null;
+  if (!project || !project.worktreeAllowedUsers || !Object.prototype.hasOwnProperty.call(project.worktreeAllowedUsers, slug)) return false;
+  delete project.worktreeAllowedUsers[slug];
+  if (Object.keys(project.worktreeAllowedUsers).length === 0) delete project.worktreeAllowedUsers;
+  return true;
+}
+
+function reconcileWorktreeGrants(config, parentSlug, existingSlugs) {
+  var project = findProject(config, parentSlug);
+  if (!project || !project.worktreeAllowedUsers) return false;
+  var existing = {};
+  for (var i = 0; i < existingSlugs.length; i++) existing[existingSlugs[i]] = true;
+  var changed = false;
+  var granted = Object.keys(project.worktreeAllowedUsers);
+  for (var j = 0; j < granted.length; j++) {
+    if (existing[granted[j]]) continue;
+    delete project.worktreeAllowedUsers[granted[j]];
+    changed = true;
+  }
+  if (Object.keys(project.worktreeAllowedUsers).length === 0) delete project.worktreeAllowedUsers;
+  return changed;
+}
+
+module.exports = {
+  parentSlugFor: parentSlugFor,
+  getProjectAccess: getProjectAccess,
+  setAllowedUsers: setAllowedUsers,
+  clearWorktreeGrant: clearWorktreeGrant,
+  reconcileWorktreeGrants: reconcileWorktreeGrants,
+};

package/lib/daemon-projects.js

@@ -5,9 +5,11 @@
  */
 
 var fs = require("fs");
-var { scanWorktrees, isWorktree } = require("./worktree");
+var { scanWorktreesResult, isWorktree } = require("./worktree");
 var { daemonSync } = require("./daemon-sync");
 var logContext = require("./project-log-context");
+var daemonProjectAccess = require("./daemon-project-access");
+var saveConfig = require("./config").saveConfig;
 
 // --- Worktree tracking state ---
 var worktreeRegistry = {}; // parentSlug -> [wtSlug, ...]
@@ -29,9 +31,13 @@ function isWorktreeSlug(slug) {
  * @param {string} parentIcon - icon of parent project
  * @param {string} parentOwnerId - owner user ID
  */
-function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, projectKnowledgeId, osUserInfo) {
+function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, projectKnowledgeId, osUserInfo, config) {
   if (isWorktree(parentPath, osUserInfo)) return;
-  var worktrees = scanWorktrees(parentPath, osUserInfo);
+  var scan = scanWorktreesResult(parentPath, osUserInfo);
+  if (!scan.ok) return;
+  var worktrees = scan.worktrees;
+  var currentSlugs = worktrees.map(function (worktree) { return parentSlug + "--" + worktree.dirName; });
+  if (config && daemonProjectAccess.reconcileWorktreeGrants(config, parentSlug, currentSlugs)) saveConfig(config);
   if (worktrees.length === 0) return;
   if (!worktreeRegistry[parentSlug]) worktreeRegistry[parentSlug] = [];
   for (var i = 0; i < worktrees.length; i++) {
@@ -49,7 +55,7 @@ function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, par
     console.log("[daemon] Registered worktree:", wtSlug, "->", wt.path, wt.external ? "(external)" : "(inside project folder)");
   }
   daemonSync.register(getWorktreeSyncKey(parentSlug), function () {
-    rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, null, projectKnowledgeId, osUserInfo);
+    rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, config, projectKnowledgeId, osUserInfo);
   });
 }
 
@@ -66,8 +72,15 @@ function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerI
   if (worktreeScanning[parentSlug]) return;
   worktreeScanning[parentSlug] = true;
   try {
-    var discovered = scanWorktrees(parentPath, osUserInfo);
+    var scan = scanWorktreesResult(parentPath, osUserInfo);
+    if (!scan.ok) return;
+    var discovered = scan.worktrees;
     var changed = false;
+    var discoveredSlugs = discovered.map(function (worktree) { return parentSlug + "--" + worktree.dirName; });
+    if (config && daemonProjectAccess.reconcileWorktreeGrants(config, parentSlug, discoveredSlugs)) {
+      saveConfig(config);
+      changed = true;
+    }
     var existingSlugs = worktreeRegistry[parentSlug] || [];
     var discoveredNames = {};
     for (var i = 0; i < discovered.length; i++) {
@@ -96,6 +109,7 @@ function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerI
       if (!discoveredNames[dirName]) {
         if (relay.setProjectLogContextState) relay.setProjectLogContextState(sSlug, "archived");
         relay.removeProject(sSlug);
+        if (config && daemonProjectAccess.clearWorktreeGrant(config, sSlug)) saveConfig(config);
         existingSlugs.splice(si, 1);
         console.log("[daemon] Rescan: removed stale worktree:", sSlug);
         changed = true;

package/lib/daemon.js

@@ -36,6 +36,7 @@ var { createWorktree, removeWorktree, isWorktree } = require("./worktree");
 var mates = require("./mates");
 var mateKnowledgeMigration = require("./mate-knowledge-migration");
 var { isWorktreeSlug, scanAndRegisterWorktrees, rescanWorktrees, cleanupWorktreesForParent, getFilteredRemovedProjects, registerWorktreeSlug, unregisterWorktreeSlug } = require("./daemon-projects");
+var daemonProjectAccess = require("./daemon-project-access");
 var projectLogContext = require("./project-log-context");
 
 var daemonVersion = require("../package.json").version;
@@ -186,7 +187,7 @@ function worktreeOsUserInfo(project, requestUser) {
 function registerProjectWorktrees(project, requestUser) {
   try {
     var osUserInfo = worktreeOsUserInfo(project, requestUser);
-    scanAndRegisterWorktrees(relay, project.path, project.slug, project.icon, project.ownerId, project.projectKnowledgeId, osUserInfo);
+    scanAndRegisterWorktrees(relay, project.path, project.slug, project.icon, project.ownerId, project.projectKnowledgeId, osUserInfo, config);
   } catch (e) {
     console.error("[daemon] Failed to scan worktrees for " + project.slug + ": " + e.message);
   }
@@ -440,6 +441,7 @@ var relay = createServer({
       }
       relay.removeProject(slug);
       unregisterWorktreeSlug(wtParent, slug);
+      if (daemonProjectAccess.clearWorktreeGrant(config, slug)) saveConfig(config);
       console.log("[daemon] Removed worktree (web):", slug);
       relay.broadcastAll({
         type: "projects_updated",
@@ -599,6 +601,7 @@ var relay = createServer({
       projects: relay.getProjects(),
       projectCount: config.projects.length,
     });
+    if (relay.refreshProjectAccess) relay.refreshProjectAccess();
     return { ok: true };
   },
   onGetProjectEnv: function (slug) {
@@ -960,20 +963,27 @@ var relay = createServer({
             }
           }
         }
+        if (relay.refreshProjectAccess) relay.refreshProjectAccess();
         return { ok: true };
       }
     }
     return { error: "Project not found" };
   },
   onSetProjectAllowedUsers: function (slug, allowedUsers) {
+    var accessBefore = daemonProjectAccess.getProjectAccess(config, slug, config.osUsers);
+    var result = daemonProjectAccess.setAllowedUsers(config, slug, allowedUsers);
+    if (result.error) return result;
+    var parentSlug = daemonProjectAccess.parentSlugFor(slug);
     for (var i = 0; i < config.projects.length; i++) {
-      if (config.projects[i].slug === slug) {
-        var prev = config.projects[i].allowedUsers || [];
-        config.projects[i].allowedUsers = allowedUsers;
+      if (config.projects[i].slug === (parentSlug || slug)) {
+        var prev = accessBefore && !accessBefore.error
+          ? (parentSlug ? accessBefore.worktreeAllowedUsers : accessBefore.allowedUsers)
+          : [];
         saveConfig(config);
-        console.log("[daemon] Set project allowed users:", slug, "→", allowedUsers.length, "users");
+        console.log("[daemon] Set project allowed users:", slug, "→", result.allowedUsers.length, "users");
         // OS users mode: sync ACLs for added/removed users
-        if (config.osUsers) {
+        // Exact-worktree grants are Clay-only and never change filesystem ACLs.
+        if (config.osUsers && !parentSlug) {
           var projectPath = config.projects[i].path;
           // Grant access to newly added users
           for (var a = 0; a < allowedUsers.length; a++) {
@@ -994,24 +1004,14 @@ var relay = createServer({
             }
           }
         }
+        if (relay.refreshProjectAccess) relay.refreshProjectAccess();
         return { ok: true };
       }
     }
     return { error: "Project not found" };
   },
   onGetProjectAccess: function (slug) {
-    for (var i = 0; i < config.projects.length; i++) {
-      if (config.projects[i].slug === slug) {
-        var isMateProject = slug.indexOf("mate-") === 0;
-        return {
-          slug: slug,
-          visibility: isMateProject ? "private" : (config.projects[i].visibility || (config.osUsers ? "private" : "public")),
-          allowedUsers: config.projects[i].allowedUsers || [],
-          ownerId: config.projects[i].ownerId || null,
-        };
-      }
-    }
-    return { error: "Project not found" };
+    return daemonProjectAccess.getProjectAccess(config, slug, config.osUsers);
   },
   onUserProvisioned: function (userId, linuxUser) {
     // Grant ACL on all public projects to the newly provisioned user
@@ -1048,6 +1048,7 @@ var relay = createServer({
     if (!result.ok) return result;
     // Register the new worktree as ephemeral project
     var wtSlug = parentSlug + "--" + dirName;
+    if (daemonProjectAccess.clearWorktreeGrant(config, wtSlug)) saveConfig(config);
     var context = projectLogContext.resolveWorktreeContext(result.path, parent.projectKnowledgeId, {
       branch: branchName,
       baseCommit: baseCommit,

package/lib/project-logs-access-scope.js

@@ -0,0 +1,94 @@
+// Authorization and record scoping for a Project Logs binding. Worktree-only
+// principals share storage with the parent but never inherit its ledger view.
+
+function attachProjectLogsAccessScope(ctx) {
+  var projectFor = ctx.projectFor;
+  var isMultiUser = ctx.isMultiUser;
+  var canAccessProject = ctx.canAccessProject;
+  var hasFullProjectAccess = ctx.hasFullProjectAccess;
+  var openStore = ctx.openStore;
+
+  function effectiveStatus(status) {
+    if (!status || status.isWorktree !== true || !status.parentSlug) return status;
+    var parent = projectFor(status.parentSlug);
+    if (!parent) return status;
+    return parent.getStatus() || status;
+  }
+
+  function ownsProject(principal, status) {
+    if (!status) return false;
+    if (isMultiUser()) return !!principal.userId && status.projectOwnerId === principal.userId;
+    return !status.projectOwnerId || (!!principal.singleUserOwnerId && status.projectOwnerId === principal.singleUserOwnerId);
+  }
+
+  function projectAuthorization(principal, status) {
+    var denied = { allowed: false, worktreeOnly: false };
+    if (!status || status.isMate === true) return denied;
+    var governing = effectiveStatus(status);
+    if (ownsProject(principal, governing)) return { allowed: true, worktreeOnly: false };
+    if (!isMultiUser() || !principal.userId || typeof canAccessProject !== "function") return denied;
+    if (canAccessProject(principal.userId, status) !== true) return denied;
+    var full = status.isWorktree !== true;
+    if (!full && typeof hasFullProjectAccess === "function") {
+      full = hasFullProjectAccess(principal.userId, status) === true;
+    }
+    return { allowed: true, worktreeOnly: !full };
+  }
+
+  function authorizedProject(principal, status) {
+    return projectAuthorization(principal, status).allowed === true;
+  }
+
+  function storeForStatus(status) {
+    var governing = effectiveStatus(status);
+    if (!governing || !governing.path) throw new Error("Project Logs are unavailable for this project.");
+    return openStore(governing.path, { projectKnowledgeId: governing.projectKnowledgeId || null });
+  }
+
+  function recordContext(status) {
+    if (!status || status.isWorktree !== true || !status.changeSetId) return null;
+    return {
+      kind: "worktree",
+      changeSetId: status.changeSetId,
+      branch: status.branch || null,
+      baseCommit: status.baseCommit || null,
+      headCommit: status.headCommit || null,
+      status: "active",
+    };
+  }
+
+  function scopedArgs(args, status, worktreeOnly) {
+    var out = Object.assign({}, args || {});
+    if (worktreeOnly) {
+      out.contextMode = "current";
+      out.exactChangeSet = true;
+    } else if (!out.contextMode) {
+      out.contextMode = status && status.isWorktree ? "current" : "project";
+    }
+    out.currentChangeSetId = status && status.changeSetId || null;
+    return out;
+  }
+
+  function visibleEntry(store, ref, status, worktreeOnly) {
+    var entry = store.read(ref, false);
+    if (!entry) throw new Error("Log entry not found.");
+    if (worktreeOnly) {
+      var changeSetId = entry.context && entry.context.changeSetId;
+      if (!changeSetId || changeSetId !== status.changeSetId) throw new Error("Log entry not found.");
+    }
+    return entry;
+  }
+
+  return {
+    effectiveStatus: effectiveStatus,
+    ownsProject: ownsProject,
+    projectAuthorization: projectAuthorization,
+    authorizedProject: authorizedProject,
+    storeForStatus: storeForStatus,
+    recordContext: recordContext,
+    scopedArgs: scopedArgs,
+    visibleEntry: visibleEntry,
+  };
+}
+
+module.exports = { attachProjectLogsAccessScope: attachProjectLogsAccessScope };

package/lib/project-logs-query.js

@@ -70,6 +70,9 @@ function contextMode(options) {
 function matchesContext(entry, options) {
   var mode = contextMode(options);
   var changeSetId = entry && entry.context && entry.context.changeSetId;
+  if (options && options.exactChangeSet === true) {
+    return !!changeSetId && changeSetId === options.currentChangeSetId;
+  }
   if (mode === "all") return true;
   if (mode === "project") return !changeSetId;
   return !changeSetId || changeSetId === options.currentChangeSetId;

package/lib/project-logs-service.js

@@ -21,6 +21,7 @@
 
 var builtinMates = require("./builtin-mates");
 var logsStore = require("./project-logs-store");
+var attachProjectLogsAccessScope = require("./project-logs-access-scope").attachProjectLogsAccessScope;
 var LOG_REF_PATTERN = /^log:[A-Za-z0-9_-]{24}$/;
 
 function readOnly() {
@@ -52,7 +53,6 @@ function attachProjectLogsService(ctx) {
   var getProjects = context.getProjects;
   var isMultiUser = context.isMultiUser;
   var resolveMate = context.resolveMate;
-  var canAccessProject = context.canAccessProject;
   var findUserById = context.findUserById || function () { return null; };
   var storeCache = new Map();
 
@@ -75,61 +75,21 @@ function attachProjectLogsService(ctx) {
     return (projects && projects.get(slug)) || null;
   }
 
-  // A worktree inherits its parent's visibility, so authorization is decided
-  // against the parent whenever the parent is registered.
-  function effectiveStatus(status) {
-    if (!status || status.isWorktree !== true || !status.parentSlug) return status;
-    var parent = projectFor(status.parentSlug);
-    if (!parent) return status;
-    var parentStatus = parent.getStatus();
-    return parentStatus || status;
-  }
-
-  function ownsProject(principal, status) {
-    if (!status) return false;
-    if (isMultiUser()) return !!principal.userId && status.projectOwnerId === principal.userId;
-    return !status.projectOwnerId || (!!principal.singleUserOwnerId && status.projectOwnerId === principal.singleUserOwnerId);
-  }
-
-  function authorizedProject(principal, status) {
-    if (!status) return false;
-    if (status.isMate === true) return false;
-    var governing = effectiveStatus(status);
-    if (ownsProject(principal, governing)) return true;
-    if (isMultiUser() && principal.userId && typeof canAccessProject === "function") {
-      return canAccessProject(principal.userId, governing) === true;
-    }
-    return false;
-  }
-
-  // Open the store for the governing project. When a worktree's parent is
-  // registered, its path is authoritative, so worktree Logs are shared without
-  // depending on a Git subprocess. The store's own root resolution remains the
-  // fallback for unregistered parents and for subdirectories of a checkout.
-  function storeForStatus(status) {
-    var governing = effectiveStatus(status);
-    if (!governing || !governing.path) throw new Error("Project Logs are unavailable for this project.");
-    return openStore(governing.path, { projectKnowledgeId: governing.projectKnowledgeId || null });
-  }
-
-  function recordContext(status) {
-    if (!status || status.isWorktree !== true || !status.changeSetId) return null;
-    return {
-      kind: "worktree",
-      changeSetId: status.changeSetId,
-      branch: status.branch || null,
-      baseCommit: status.baseCommit || null,
-      headCommit: status.headCommit || null,
-      status: "active",
-    };
-  }
-
-  function scopedArgs(args, status) {
-    var out = Object.assign({}, args || {});
-    if (!out.contextMode) out.contextMode = status && status.isWorktree ? "current" : "project";
-    out.currentChangeSetId = status && status.changeSetId || null;
-    return out;
-  }
+  var logScope = attachProjectLogsAccessScope({
+    projectFor: projectFor,
+    isMultiUser: isMultiUser,
+    canAccessProject: context.canAccessProject,
+    hasFullProjectAccess: context.hasFullProjectAccess,
+    openStore: openStore,
+  });
+  var effectiveStatus = logScope.effectiveStatus;
+  var ownsProject = logScope.ownsProject;
+  var projectAuthorization = logScope.projectAuthorization;
+  var authorizedProject = logScope.authorizedProject;
+  var storeForStatus = logScope.storeForStatus;
+  var recordContext = logScope.recordContext;
+  var scopedArgs = logScope.scopedArgs;
+  var visibleEntry = logScope.visibleEntry;
 
   function statusFor(principal, slug) {
     var project = projectFor(slug);
@@ -317,6 +277,20 @@ function attachProjectLogsService(ctx) {
       return project.getStatus();
     }
 
+    function currentScope() {
+      var current = revalidate();
+      var project = projectFor(current.principal.projectSlug);
+      var status = project && project.getStatus();
+      var decision = projectAuthorization(current.principal, status);
+      if (!decision.allowed) throw new Error("Project Logs are not available for this project.");
+      return { status: status, worktreeOnly: decision.worktreeOnly };
+    }
+
+    function scopedEntry(args) {
+      var scope = currentScope();
+      return visibleEntry(live(), args && args.ref, scope.status, scope.worktreeOnly);
+    }
+
     function mutationContext() {
       return recordContext(currentStatus());
     }
@@ -336,8 +310,9 @@ function attachProjectLogsService(ctx) {
       root: store.root,
       author: initial.author,
       listLogs: function (args) {
-        var status = currentStatus();
-        var options = scopedArgs(args, status);
+        var scope = currentScope();
+        var status = scope.status;
+        var options = scopedArgs(args, status, scope.worktreeOnly);
         var result = live().list(options);
         result.contextMode = options.contextMode;
         result.currentChangeSetId = status.changeSetId || null;
@@ -345,8 +320,9 @@ function attachProjectLogsService(ctx) {
         return result;
       },
       searchLogs: function (args) {
-        var status = currentStatus();
-        var options = scopedArgs(args, status);
+        var scope = currentScope();
+        var status = scope.status;
+        var options = scopedArgs(args, status, scope.worktreeOnly);
         var result = live().search(options);
         result.contextMode = options.contextMode;
         result.currentChangeSetId = status.changeSetId || null;
@@ -354,21 +330,22 @@ function attachProjectLogsService(ctx) {
         return result;
       },
       readLog: function (args) {
-        var entry = live().read(args && args.ref, false);
-        if (!entry) throw new Error("Log entry not found.");
-        return entry;
+        return scopedEntry(args);
       },
-      logHistory: function (args) { return live().history(args && args.ref, args || {}); },
-      commentLog: function (args) { return live().comment(args && args.ref, args || {}, author(), mutationContext()); },
-      readLogRevision: function (args) { return live().readRevision(args && args.ref, args && args.revision); },
-      listLogFeedback: canonical ? function (args) { return live().feedback(args || {}); } : driverOnly,
-      reviewLogComment: canonical ? function (args) { return live().review(args && args.ref, args || {}, author(), mutationContext()); } : driverOnly,
+      logHistory: function (args) { scopedEntry(args); return live().history(args && args.ref, args || {}); },
+      commentLog: function (args) { scopedEntry(args); return live().comment(args && args.ref, args || {}, author(), mutationContext()); },
+      readLogRevision: function (args) { scopedEntry(args); return live().readRevision(args && args.ref, args && args.revision); },
+      listLogFeedback: canonical ? function (args) {
+        var scope = currentScope();
+        return live().feedback(scopedArgs(args, scope.status, scope.worktreeOnly));
+      } : driverOnly,
+      reviewLogComment: canonical ? function (args) { scopedEntry(args); return live().review(args && args.ref, args || {}, author(), mutationContext()); } : driverOnly,
       revertLog: canonical
-        ? function (args) { return live().revert(args && args.ref, args && args.revision, args && args.reason, author(), mutationContext()); }
+        ? function (args) { scopedEntry(args); return live().revert(args && args.ref, args && args.revision, args && args.reason, author(), mutationContext()); }
         : driverOnly,
       createLog: canonical ? function (args) { return live().create(args || {}, author(), mutationContext()); } : agentOnly,
-      updateLog: canonical ? function (args) { return live().update(args && args.ref, args || {}, author(), mutationContext()); } : agentOnly,
-      linkLog: canonical ? function (args) { return live().link(args && args.ref, args && args.links, author(), mutationContext()); } : agentOnly,
+      updateLog: canonical ? function (args) { scopedEntry(args); return live().update(args && args.ref, args || {}, author(), mutationContext()); } : agentOnly,
+      linkLog: canonical ? function (args) { scopedEntry(args); return live().link(args && args.ref, args && args.links, author(), mutationContext()); } : agentOnly,
       removeLog: canDelete ? function (args) {
         var current = revalidate();
         var project = projectFor(current.principal.projectSlug);
@@ -376,6 +353,7 @@ function attachProjectLogsService(ctx) {
         if (!project || !authorizedProject(current.principal, currentStatus)) {
           throw new Error("Project Logs are not available for this project.");
         }
+        visibleEntry(storeForStatus(currentStatus), args && args.ref, currentStatus, projectAuthorization(current.principal, currentStatus).worktreeOnly);
         if (current.principal.kind !== "session" && !ownsProject(current.principal, currentStatus)) ownerOnly();
         return storeForStatus(currentStatus).remove(args && args.ref, current.author, recordContext(currentStatus));
       } : ownerOnly,
@@ -394,7 +372,17 @@ function attachProjectLogsService(ctx) {
       var principal = revalidate();
       var slug = args && args.projectSlug;
       if (!slug) throw new Error("An exact project slug is required.");
-      return storeForStatus(statusFor(principal, slug));
+      var status = statusFor(principal, slug);
+      var decision = projectAuthorization(principal, status);
+      return { store: storeForStatus(status), status: status, worktreeOnly: decision.worktreeOnly };
+    }
+
+    function targetEntry(args) {
+      var selected = target(args);
+      return {
+        selected: selected,
+        entry: visibleEntry(selected.store, args && args.ref, selected.status, selected.worktreeOnly),
+      };
     }
 
     function resolveLogNavigation(args) {
@@ -408,15 +396,19 @@ function attachProjectLogsService(ctx) {
       projects.forEach(function (project, slug) {
         if (!project || typeof project.getStatus !== "function") return;
         var status = project.getStatus();
-        if (!authorizedProject(principal, status)) return;
+        var decision = projectAuthorization(principal, status);
+        if (!decision.allowed) return;
         var governing = effectiveStatus(status);
         var scope = governing && (governing.projectKnowledgeId || governing.path);
-        if (!scope || seenScopes.has(scope)) return;
-        seenScopes.add(scope);
+        var scopeKey = decision.worktreeOnly ? scope + ":" + (status.changeSetId || slug) : scope;
+        if (!scope || seenScopes.has(scopeKey)) return;
+        seenScopes.add(scopeKey);
         var entry = null;
-        try { entry = storeForStatus(status).read(ref, false); } catch (e) { return; }
+        try { entry = visibleEntry(storeForStatus(status), ref, status, decision.worktreeOnly); } catch (e) { return; }
         if (!entry) return;
-        var targetSlug = status.isWorktree && status.parentSlug && projectFor(status.parentSlug) ? status.parentSlug : slug;
+        var targetSlug = decision.worktreeOnly
+          ? slug
+          : (status.isWorktree && status.parentSlug && projectFor(status.parentSlug) ? status.parentSlug : slug);
         if (match && match.projectSlug !== targetSlug) throw new Error("Log reference is ambiguous.");
         match = { projectSlug: targetSlug, ref: ref };
       });
@@ -431,16 +423,26 @@ function attachProjectLogsService(ctx) {
       canDelete: false,
       projectSlug: null,
       author: null,
-      listLogs: function (args) { return target(args).list(args || {}); },
-      searchLogs: function (args) { return target(args).search(args || {}); },
+      listLogs: function (args) {
+        var selected = target(args);
+        return selected.store.list(scopedArgs(args, selected.status, selected.worktreeOnly));
+      },
+      searchLogs: function (args) {
+        var selected = target(args);
+        return selected.store.search(scopedArgs(args, selected.status, selected.worktreeOnly));
+      },
       readLog: function (args) {
-        var entry = target(args).read(args && args.ref, false);
-        if (!entry) throw new Error("Log entry not found.");
-        return entry;
+        return targetEntry(args).entry;
+      },
+      logHistory: function (args) {
+        var selected = targetEntry(args).selected;
+        return selected.store.history(args && args.ref, args || {});
       },
-      logHistory: function (args) { return target(args).history(args && args.ref, args || {}); },
       commentLog: readOnly,
-      readLogRevision: function (args) { return target(args).readRevision(args && args.ref, args && args.revision); },
+      readLogRevision: function (args) {
+        var selected = targetEntry(args).selected;
+        return selected.store.readRevision(args && args.ref, args && args.revision);
+      },
       resolveLogNavigation: resolveLogNavigation,
       listLogFeedback: readOnly,
       reviewLogComment: readOnly,