clay-server 4.1.0 → 4.2.0-beta.1

package/lib/daemon-project-access.js

@@ -41,6 +41,7 @@ function getProjectAccess(config, slug, osUsers) {
       visibility: visibility,
       allowedUsers: parentAllowedUsers,
       ownerId: project.ownerId || null,
+      sessionVisibilityDefault: project.sessionVisibilityDefault === "shared" ? "shared" : "private",
       isWorktree: false,
     };
   }
@@ -52,6 +53,7 @@ function getProjectAccess(config, slug, osUsers) {
     visibility: visibility,
     allowedUsers: uniqueUsers(parentAllowedUsers.concat(worktreeAllowedUsers)),
     ownerId: project.ownerId || null,
+    sessionVisibilityDefault: project.sessionVisibilityDefault === "shared" ? "shared" : "private",
     isWorktree: true,
     parentSlug: parentSlug,
     parentAllowedUsers: parentAllowedUsers,
@@ -61,6 +63,7 @@ function getProjectAccess(config, slug, osUsers) {
       visibility: visibility,
       allowedUsers: parentAllowedUsers,
       ownerId: project.ownerId || null,
+      sessionVisibilityDefault: project.sessionVisibilityDefault === "shared" ? "shared" : "private",
     },
   };
 }
@@ -84,6 +87,16 @@ function setAllowedUsers(config, slug, allowedUsers) {
   return { ok: true, isWorktree: true, allowedUsers: clean };
 }
 
+function setSessionVisibilityDefault(config, slug, visibility) {
+  if (visibility !== "private" && visibility !== "shared") return { error: "Invalid session visibility default" };
+  if (parentSlugFor(slug)) return { error: "Worktrees inherit this setting from their parent project." };
+  var project = findProject(config, slug);
+  if (!project) return { error: "Project not found" };
+  if (visibility === "shared") project.sessionVisibilityDefault = "shared";
+  else delete project.sessionVisibilityDefault;
+  return { ok: true, visibility: visibility };
+}
+
 function clearWorktreeGrant(config, slug) {
   var parentSlug = parentSlugFor(slug);
   var project = parentSlug ? findProject(config, parentSlug) : null;
@@ -113,6 +126,7 @@ module.exports = {
   parentSlugFor: parentSlugFor,
   getProjectAccess: getProjectAccess,
   setAllowedUsers: setAllowedUsers,
+  setSessionVisibilityDefault: setSessionVisibilityDefault,
   clearWorktreeGrant: clearWorktreeGrant,
   reconcileWorktreeGrants: reconcileWorktreeGrants,
 };

package/lib/daemon.js

@@ -556,6 +556,13 @@ var relay = createServer({
     });
     return { ok: true };
   },
+  onSetProjectSessionVisibilityDefault: function (slug, visibility) {
+    var result = daemonProjectAccess.setSessionVisibilityDefault(config, slug, visibility);
+    if (result.error) return { ok: false, error: result.error };
+    saveConfig(config);
+    relay.broadcastAll({ type: "projects_updated", projects: relay.getProjects(), projectCount: config.projects.length });
+    return result;
+  },
   onProjectOwnerChanged: function (slug, ownerId) {
     console.log("[daemon] onProjectOwnerChanged:", slug, "→", ownerId);
     var oldOwnerId = null;

package/lib/project-issue-launch.js

@@ -2,6 +2,7 @@
 
 var yoke = require("./yoke");
 var provenance = require("./session-provenance");
+var sessionVisibility = require("./session-visibility");
 
 function attachIssueLaunch(ctx) {
   var requests = new Map();
@@ -79,8 +80,9 @@ function attachIssueLaunch(ctx) {
     var liveLinuxUser = typeof ctx.getLinuxUserForSession === "function" ? ctx.getLinuxUserForSession({ ownerId: actorId }) : null;
     if (osUsersEnabled() && liveLinuxUser !== expectedLinuxUser) throw new Error("The OS identity changed while issue work was being prepared.");
 
+    var projectAccess = typeof ctx.getProjectAccess === "function" ? ctx.getProjectAccess() : null;
     var session = ctx.sm.createSessionRaw({ vendor: runtime.vendor, model: runtime.model, effort: runtime.effort || null,
-      mode: "gui", ownerId: actor && actor.id || null, sessionVisibility: "private" });
+      mode: "gui", ownerId: actor && actor.id || null, sessionVisibility: sessionVisibility.defaultForProject(projectAccess) });
     provenance.ensureOrigin(session);
     if (session.hidden === true || session.delegated === true || provenance.isWorker(session)) {
       ctx.sm.deleteSession(session.localId);

package/lib/project-sessions.js

@@ -555,7 +555,7 @@ function attachSessions(ctx) {
     }
     sm.sweepBlankSessions();
     var sessionOpts = {
-      sessionVisibility: sessionVisibility.normalize(msg.sessionVisibility),
+      sessionVisibility: "private",
       vendor: prepared.runtime.vendor,
       model: prepared.runtime.model,
       effort: prepared.runtime.effort || null,
@@ -619,7 +619,15 @@ function attachSessions(ctx) {
       sm.sweepBlankSessions();
       var sessionOpts = {};
       if (ws._clayUser && usersModule.isMultiUser()) sessionOpts.ownerId = ws._clayUser.id;
-      sessionOpts.sessionVisibility = sessionVisibility.normalize(msg.sessionVisibility);
+      // Only ordinary project conversations may opt into this setting.
+      // Scheduled interviews and background/worker creation paths remain explicit.
+      var visibilityChoice = sessionVisibility.resolveNewSessionVisibility(getProjectAccess(), msg, isMate);
+      if (visibilityChoice.error) {
+        scheduledRequestError(ws, msg, visibilityChoice.error);
+        if (!msg.requestId) sendTo(ws, { type: "error", text: visibilityChoice.error });
+        return true;
+      }
+      sessionOpts.sessionVisibility = visibilityChoice.visibility;
       if (msg.vendor) sessionOpts.vendor = msg.vendor;
       // Mode resolution: vendors without a TUI session mode are always GUI.
       // TUI-capable sessions honor the explicit msg.mode if provided, otherwise
@@ -701,8 +709,7 @@ function attachSessions(ctx) {
         if (reusable) {
           if (sessionOpts.vendor && reusable.vendor !== sessionOpts.vendor) reusable.vendor = sessionOpts.vendor;
           if (!reusable.effort) reusable.effort = sessionOpts.effort;
-          sm.setSessionVisibility(reusable.localId, sessionOpts.sessionVisibility);
-          sessionVisibility.revokeViewers(ctx, reusable);
+          // Reusable blanks already exist; do not retroactively change them.
           sm.switchSession(reusable.localId, ws);
           newSess = reusable;
         } else {
@@ -735,6 +742,14 @@ function attachSessions(ctx) {
       return true;
     }
 
+    if (msg.type === "set_project_session_visibility_default") {
+      sessionVisibility.handleDefaultChange({
+        slug: slug, isMate: isMate, osUsers: osUsers, usersModule: usersModule, getProjectAccess: getProjectAccess,
+        opts: opts, sendTo: sendTo,
+      }, ws, msg);
+      return true;
+    }
+
     if (msg.type === "set_session_bookmark") {
       if (typeof msg.sessionId === "number") {
         var bookmarkTarget = sm.sessions.get(msg.sessionId);
@@ -1493,7 +1508,11 @@ function attachSessions(ctx) {
           } else {
             forkHistory = session.history.slice();
           }
-          var forked = sm.createSession({ vendor: session.vendor, ownerId: session.ownerId || null }, ws);
+          var forked = sm.createSession({
+            vendor: session.vendor,
+            ownerId: session.ownerId || null,
+            sessionVisibility: sessionVisibility.normalize(session.sessionVisibility),
+          }, ws);
           forked.cliSessionId = result.sessionId;
           forked.title = forkTitle;
           forked.history = forkHistory;
@@ -1511,7 +1530,14 @@ function attachSessions(ctx) {
           // Read history from CLI session files
           var cliSess = require("./cli-sessions");
           return cliSess.readCliSessionHistory(resolveSessionHome(session), cwd, result.sessionId).then(function(history) {
-            var forked = sm.resumeSession(result.sessionId, { history: history, title: forkTitle }, ws);
+            var forked = sm.resumeSession(result.sessionId, {
+              history: history,
+              title: forkTitle,
+              vendor: session.vendor,
+              ownerId: session.ownerId || null,
+              sessionVisibility: sessionVisibility.normalize(session.sessionVisibility),
+              sessionVisibilityExplicit: session.sessionVisibilityExplicit === true,
+            }, ws);
             if (forked) {
               ws._clayActiveSession = forked.localId;
               sendTo(ws, { type: "fork_complete", sessionId: forked.localId });

package/lib/project.js

@@ -794,6 +794,10 @@ function createProjectContext(opts) {
   var _issueWork = require("./project-issue-launch").attachIssueLaunch({
     sm: sm, resolveDefaultAi: opts.resolveDefaultAi, getSdk: function () { return sdk; },
     getLinuxUserForSession: getLinuxUserForSession, osUsers: osUsers,
+    getProjectAccess: function () {
+      if (isMate) return { visibility: "private", ownerId: projectOwnerId || null, allowedUsers: [] };
+      return opts.getProjectAccess ? opts.getProjectAccess() : { visibility: "public", ownerId: projectOwnerId || null };
+    },
     ensureProjectAccessForSession: ensureProjectAccessForSession,
     canStartWork: function (ws, actor) { return clients.has(ws) && ws.readyState === 1 && ws._clayUser === actor; },
     onProcessingChanged: onProcessingChanged, sendTo: sendTo,

package/lib/public/app.js

@@ -432,6 +432,7 @@ import { initDebate, handleDebatePreparing, handleDebateStarted, handleDebateRes
     defaultAiDraft: { vendor: "", model: "", effort: "" },
     defaultAiDraftDirty: false,
     defaultVendorState: { loading: false, saving: false, getRequestId: null, saveRequestId: null, preference: null, preferencePresent: false, installedVendors: [], accountId: null, projectSlug: null, serverEpoch: null, canonicalRevision: 0, error: "" },
+    projectSessionVisibilityState: { active: null, pending: null },
 
     // dm
     dmTargetUser: null,

package/lib/public/css/command-palette.css

@@ -512,9 +512,45 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
 .search-clay-activity-item small { color: var(--text-dimmer); font-size: 10px; line-height: 1.35; }
 @keyframes searchClaySpin { to { transform: rotate(360deg); } }
 
-.clayos-session-link,
-.clayos-issue-link,
-.clayos-log-link {
+.clayos-record-link {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  min-height: 28px;
+  margin: 2px 1px;
+  padding: 3px 8px 3px 6px;
+  border: 1px solid color-mix(in srgb, var(--record-color, var(--accent)) 32%, var(--border));
+  border-radius: 8px;
+  background: color-mix(in srgb, var(--record-color, var(--accent)) 7%, var(--bg-alt));
+  color: var(--text);
+  font: inherit;
+  font-size: 11px;
+  line-height: 1;
+  vertical-align: middle;
+  cursor: pointer;
+}
+.clayos-record-link::before {
+  content: "\2197";
+  display: grid;
+  place-items: center;
+  width: 17px;
+  height: 17px;
+  border-radius: 5px;
+  background: color-mix(in srgb, var(--record-color, var(--accent)) 14%, transparent);
+  color: var(--record-color, var(--accent));
+  font-size: 12px;
+}
+.clayos-record-link > span { font-weight: 620; }
+.clayos-record-link > small { min-width: 0; max-width: 28em; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; border-inline-start: 1px solid color-mix(in srgb, currentColor 22%, transparent); padding-inline-start: 6px; color: var(--text-muted); font-size: 11px; }
+.clayos-record-link:hover { border-color: color-mix(in srgb, var(--record-color, var(--accent)) 58%, var(--border)); background: color-mix(in srgb, var(--record-color, var(--accent)) 11%, var(--bg-alt)); }
+.clayos-record-link:focus-visible { outline: 2px solid var(--record-color, var(--accent)); outline-offset: 2px; }
+.clayos-record-link.is-loading { opacity: 0.62; cursor: progress; }
+.clayos-record-link.is-loading::before { animation: searchClaySpin 1.2s linear infinite; }
+.clayos-record-link.is-error { border-color: color-mix(in srgb, var(--warning) 48%, var(--border)); }
+.clayos-issue-link { --record-color: var(--link, var(--accent)); }
+.clayos-log-link { --record-color: var(--accent); }
+
+.clayos-session-link {
   display: inline-flex;
   align-items: center;
   gap: 6px;
@@ -531,9 +567,7 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
   vertical-align: middle;
   cursor: pointer;
 }
-.clayos-session-link::before,
-.clayos-issue-link::before,
-.clayos-log-link::before {
+.clayos-session-link::before {
   content: "\2197";
   display: grid;
   place-items: center;
@@ -544,29 +578,13 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
   color: var(--accent);
   font-size: 12px;
 }
-.clayos-issue-link::before,
-.clayos-log-link::before { content: "\2261"; }
-.clayos-session-link > span,
-.clayos-issue-link > span,
-.clayos-log-link > span { font-weight: 620; }
-.clayos-session-link > small,
-.clayos-issue-link > small,
-.clayos-log-link > small { color: var(--text-muted); font-size: 10px; }
-.clayos-session-link:hover,
-.clayos-issue-link:hover,
-.clayos-log-link:hover { border-color: color-mix(in srgb, var(--accent) 52%, var(--border)); background: color-mix(in srgb, var(--accent) 11%, var(--bg-alt)); }
-.clayos-session-link:focus-visible,
-.clayos-issue-link:focus-visible,
-.clayos-log-link:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
-.clayos-session-link.is-loading,
-.clayos-issue-link.is-loading,
-.clayos-log-link.is-loading { opacity: 0.62; cursor: progress; }
-.clayos-session-link.is-loading::before,
-.clayos-issue-link.is-loading::before,
-.clayos-log-link.is-loading::before { animation: searchClaySpin 1.2s linear infinite; }
-.clayos-session-link.is-error,
-.clayos-issue-link.is-error,
-.clayos-log-link.is-error { border-color: color-mix(in srgb, var(--warning) 48%, var(--border)); }
+.clayos-session-link > span { font-weight: 620; }
+.clayos-session-link > small { color: var(--text-muted); font-size: 10px; }
+.clayos-session-link:hover { border-color: color-mix(in srgb, var(--accent) 52%, var(--border)); background: color-mix(in srgb, var(--accent) 11%, var(--bg-alt)); }
+.clayos-session-link:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.clayos-session-link.is-loading { opacity: 0.62; cursor: progress; }
+.clayos-session-link.is-loading::before { animation: searchClaySpin 1.2s linear infinite; }
+.clayos-session-link.is-error { border-color: color-mix(in srgb, var(--warning) 48%, var(--border)); }
 
 .search-clay-pending {
   align-self: flex-start;
@@ -925,11 +943,11 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
 }
 
 .clayos-issue-link { max-width: min(100%, 30em); box-sizing: border-box; }
+.clayos-issue-link::before,
+.clayos-log-link::before { content: "\2261"; }
 .clayos-issue-link::before { content: "\25CE"; flex: 0 0 17px; }
-.clayos-issue-link[data-status="in_progress"]::before { color: #bd923f; }
-.clayos-issue-link[data-status="resolved"]::before { content: "\2713"; color: var(--brand-green); }
+.clayos-issue-link[data-status="in_progress"]::before { color: var(--warning, var(--accent)); }
+.clayos-issue-link[data-status="resolved"]::before { content: "\2713"; color: var(--success, var(--accent)); }
 .clayos-issue-link[data-status="closed"]::before { content: "\00D7"; color: var(--text-dimmer); }
 .clayos-issue-link > span { flex-shrink: 0; }
-.clayos-issue-link > small { min-width: 0; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; }
 .clayos-log-link { max-width: 100%; box-sizing: border-box; }
-.clayos-log-link > small { min-width: 0; overflow-wrap: anywhere; line-height: 1.35; }

package/lib/public/css/issues.css

@@ -46,11 +46,11 @@
 .issue-row small { font-size: 10.5px; font-family: var(--font-mono); }
 .issue-row-meta { display: flex; align-items: baseline; flex-wrap: wrap; gap: 8px; margin-top: 8px; color: var(--text-dimmer); font: 10.5px/1.5 var(--font-mono); }
 .issue-row-meta .issue-status { font-family: var(--font-sans); }
-.issue-status { display: inline-flex; align-items: center; gap: 6px; font-size: 11px; letter-spacing: .03em; }
+.issue-status { display: inline-flex; align-items: center; gap: 6px; color: var(--text-secondary); font-size: 11px; letter-spacing: .03em; }
 .issue-status::before { content: ''; width: 7px; height: 7px; border: 1px solid currentColor; border-radius: 50%; }
-.issue-status[data-status="in_progress"] { color: #bd923f; }
-.issue-status[data-status="resolved"] { color: #479b77; }
-.issue-status[data-status="closed"] { color: var(--text-muted); }
+.issue-status[data-status="in_progress"]::before { color: var(--warning, var(--accent)); }
+.issue-status[data-status="resolved"]::before { color: var(--success, var(--accent)); }
+.issue-status[data-status="closed"]::before { color: var(--text-muted); }
 .issue-detail { max-width: 760px; margin: 0 auto; padding: 32px 28px 52px; }
 .issue-doc-chips { display: flex; align-items: center; flex-wrap: wrap; gap: 7px; margin-bottom: 10px; }
 .issue-detail .issue-doc-title { margin: 0 0 10px; font-family: var(--font-display); font-size: clamp(24px, 2.8vw, 34px); letter-spacing: -.025em; line-height: 1.12; overflow-wrap: anywhere; }

package/lib/public/index.html

@@ -830,6 +830,16 @@
                   </div>
                 </div>
               </div>
+              <div class="settings-field" id="ps-session-visibility-default-field" style="display:none">
+                <label class="settings-label" for="ps-session-visibility-default">New session visibility</label>
+                <div class="settings-hint">Applies to new project conversations and Issue Start work sessions. Existing sessions, hidden work, and delegated workflows keep their current visibility.</div>
+                <div class="settings-hint hidden" id="ps-session-visibility-default-inherited-hint">This worktree inherits the setting from its parent project. Change it there.</div>
+                <div class="settings-hint hidden" id="ps-session-visibility-default-non-current-hint">Open this project to change this setting.</div>
+                <select class="ps-select" id="ps-session-visibility-default">
+                  <option value="private">Private</option>
+                  <option value="shared">Shared with project members</option>
+                </select>
+              </div>
             </div>
           </div>
           <!-- Defaults -->

package/lib/public/modules/app-messages.js

@@ -38,6 +38,7 @@ import { handleFsList, handleFsRead, handleFileChanged, handleDirChanged, handle
 import { beginMarkdownTurn, finishMarkdownTurn, markdownPathFromToolInput } from './markdown-live-edit.js';
 import { forwardPaneMarkdownPresentation } from './pane-bridge.js';
 import { isProjectSettingsOpen, handleInstructionsRead, handleInstructionsWrite, handleProjectEnv, handleProjectEnvSaved, handleProjectSharedEnv, handleProjectSharedEnvSaved, handleProjectOwnerChanged } from './project-settings.js';
+import { handleProjectSessionVisibilityDefault, refreshProjectSessionVisibilitySettings } from './project-session-visibility-settings.js';
 import { updateSettingsStats, updateDaemonConfig, handleSetPinResult, handleKeepAwakeChanged, handleInheritGroupsChanged, handleAutoContinueChanged, handleRestartResult, handleShutdownResult, handleSharedEnv, handleSharedEnvSaved, handleGlobalClaudeMdRead, handleGlobalClaudeMdWrite } from './server-settings.js';
 import { handleTermList, handleTermCreated, sendTerminalCommand, handleTermOutput, handleTermResized, handleTermExited, handleTermClosed } from './terminal.js';
 import { attachTuiView, detachTuiView, setTuiSuspendedView, tuiHandleTermOutput, tuiHandleTermResized, tuiHandleTermExited, tuiHandleTermClosed } from './session-tui-view.js';
@@ -103,6 +104,10 @@ export function processMessage(msg) {
   if (handleScheduledTaskMessage(msg)) return;
   if (handleDefaultVendorMessage(msg)) return;
   if (handleContextViewMessage(msg)) return;
+  if (msg && msg.type === "set_project_session_visibility_default_result") {
+    handleProjectSessionVisibilityDefault(msg);
+    return;
+  }
   if (msg && msg.type === "schedule_message_result") {
     handleScheduleMessageResult(msg);
     return;
@@ -375,6 +380,7 @@ export function processMessage(msg) {
           if (spBanner) spBanner.classList.remove("hidden");
         }
         updateProjectList(msg);
+        refreshProjectSessionVisibilitySettings(msg.projects);
         break;
 
       case "update_available":
@@ -1735,6 +1741,7 @@ export function processMessage(msg) {
 
       case "projects_updated":
         updateProjectList(msg);
+        refreshProjectSessionVisibilitySettings(msg.projects);
         renderUserStrip();
         break;
 

package/lib/public/modules/clay-issue-links.js

@@ -31,6 +31,7 @@ function createIssueLink(ref, labelText) {
   var button = document.createElement("button");
   button.type = "button";
   button.className = "clayos-issue-link";
+  button.classList.add("clayos-record-link");
   button.contentEditable = "false";
   button.dataset.issueRef = ref;
   button.setAttribute("aria-label", "Open Project Issue" + (labelText ? " " + labelText : ""));

package/lib/public/modules/clay-log-links.js

@@ -28,6 +28,7 @@ function createLogLink(ref, labelText) {
   var button = document.createElement("button");
   button.type = "button";
   button.className = "clayos-log-link";
+  button.classList.add("clayos-record-link");
   button.contentEditable = "false";
   button.dataset.logRef = ref;
   button.setAttribute("aria-label", "Open Project Log" + (labelText ? " " + labelText : ""));

package/lib/public/modules/project-session-visibility-settings.js

@@ -0,0 +1,138 @@
+import { store } from './store.js';
+import { getWs } from './ws-ref.js';
+import { showToast } from './utils.js';
+
+var requestSequence = 0;
+var initialized = false;
+
+function selectElement() {
+  return document.getElementById("ps-session-visibility-default");
+}
+
+function pendingState() {
+  return (store.get('projectSessionVisibilityState') || {}).pending || null;
+}
+
+function activeState() {
+  return (store.get('projectSessionVisibilityState') || {}).active || null;
+}
+
+function setVisibilityState(active, pending) {
+  store.set({ projectSessionVisibilityState: { active: active || null, pending: pending || null } });
+}
+
+function setSelectState(select, value, disabled) {
+  if (!select) return;
+  select.value = value;
+  select.disabled = !!disabled;
+}
+
+function isCurrentProject(active) {
+  return !!(active && active.slug && active.slug === store.get('currentSlug'));
+}
+
+function isReadOnly(active) {
+  return !active || !active.authorized || active.isWorktree || !isCurrentProject(active);
+}
+
+function renderActiveState() {
+  var active = activeState();
+  var pending = pendingState();
+  var select = selectElement();
+  var inheritedHint = document.getElementById("ps-session-visibility-default-inherited-hint");
+  var nonCurrentHint = document.getElementById("ps-session-visibility-default-non-current-hint");
+  if (inheritedHint) inheritedHint.classList.toggle("hidden", !(active && active.isWorktree));
+  if (nonCurrentHint) nonCurrentHint.classList.toggle("hidden", !(active && active.authorized && !active.isWorktree && !isCurrentProject(active)));
+  if (!select || !active) return;
+  setSelectState(select, active.effectiveValue, isReadOnly(active) || !!(pending && pending.slug === active.slug));
+}
+
+function isAuthorized(project) {
+  var users = store.get('cachedAllUsers') || [];
+  var userId = store.get('myUserId');
+  var currentUser = null;
+  for (var i = 0; i < users.length; i++) {
+    if (users[i].id === userId) { currentUser = users[i]; break; }
+  }
+  return !!(store.get('isMultiUserMode') && project &&
+    ((project.projectOwnerId && project.projectOwnerId === userId) || (currentUser && currentUser.role === "admin")) &&
+    (!store.get('permissions') || store.get('permissions').projectSettings !== false));
+}
+
+export function initProjectSessionVisibilitySettings() {
+  var select = selectElement();
+  if (!select || initialized) return;
+  initialized = true;
+  select.addEventListener("change", function () {
+    var ws = getWs();
+    var active = activeState();
+    var slug = active && active.slug || "";
+    var prior = active && active.effectiveValue || "private";
+    if (!slug || !ws || ws.readyState !== 1 || pendingState() || isReadOnly(active)) {
+      setSelectState(select, prior, isReadOnly(active) || !!pendingState());
+      return;
+    }
+    requestSequence += 1;
+    var requestId = "project-session-visibility-" + Date.now() + "-" + requestSequence;
+    setVisibilityState(active, { requestId: requestId, slug: slug, requested: select.value, previous: prior });
+    setSelectState(select, select.value, true);
+    ws.send(JSON.stringify({ type: "set_project_session_visibility_default", slug: slug, visibility: select.value, requestId: requestId }));
+  });
+
+  store.subscribe(function (state, previous) {
+    if (state.currentSlug !== previous.currentSlug) renderActiveState();
+    if (state.connected || previous.connected !== true) return;
+    var pending = pendingState();
+    if (!pending) return;
+    var current = selectElement();
+    var active = activeState();
+    if (current && active && active.slug === pending.slug) setSelectState(current, pending.previous, isReadOnly(active));
+    setVisibilityState(active, null);
+    renderActiveState();
+  });
+}
+
+export function populateProjectSessionVisibilitySettings(slug, project) {
+  var field = document.getElementById("ps-session-visibility-default-field");
+  var select = selectElement();
+  if (field) field.style.display = isAuthorized(project) ? "" : "none";
+  if (!select) return;
+  var value = project && project.sessionVisibilityDefault === "shared" ? "shared" : "private";
+  var active = { slug: slug || "", effectiveValue: value, isWorktree: !!(project && project.isWorktree), authorized: isAuthorized(project) };
+  var pending = pendingState();
+  setVisibilityState(active, pending);
+  renderActiveState();
+}
+
+export function refreshProjectSessionVisibilitySettings(projects) {
+  var select = selectElement();
+  if (!select) return;
+  var active = activeState();
+  var slug = active && active.slug || "";
+  var source = Array.isArray(projects) ? projects : [];
+  for (var i = 0; i < source.length; i++) {
+    if (source[i] && source[i].slug === slug) {
+      populateProjectSessionVisibilitySettings(slug, source[i]);
+      return;
+    }
+  }
+}
+
+export function handleProjectSessionVisibilityDefault(msg) {
+  var pending = pendingState();
+  if (!pending || msg.requestId !== pending.requestId || msg.slug !== pending.slug) return;
+  var active = activeState();
+  setVisibilityState(active, null);
+  var select = selectElement();
+  if (!select || !active || active.slug !== msg.slug) return;
+  if (!msg.ok) {
+    active = Object.assign({}, active, { effectiveValue: pending.previous });
+    setVisibilityState(active, null);
+    setSelectState(select, pending.previous, isReadOnly(active));
+    showToast(msg.error || "Failed to update new session visibility", "error");
+    return;
+  }
+  active = Object.assign({}, active, { effectiveValue: msg.visibility === "shared" ? "shared" : "private" });
+  setVisibilityState(active, null);
+  setSelectState(select, active.effectiveValue, isReadOnly(active));
+}

package/lib/public/modules/project-settings.js

@@ -4,6 +4,7 @@ import { showToast } from './utils.js';
 import { parseEmojis } from './markdown.js';
 import { closeFileViewer } from './filebrowser.js';
 import { renderModelList, renderModeList, renderEffortBar, renderThinkingBar, renderBetaCard } from './settings-defaults.js';
+import { initProjectSessionVisibilitySettings, populateProjectSessionVisibilitySettings } from './project-session-visibility-settings.js';
 
 var ctx = null;
 var panelEl = null;
@@ -162,6 +163,8 @@ export function initProjectSettings(appCtx, emojiCategories) {
       hideTransferForm();
     });
   }
+
+  initProjectSessionVisibilitySettings();
 }
 
 // ===== Open / Close =====
@@ -246,6 +249,8 @@ function populateProfile() {
   // Icon
   updateIconPreview(currentProject ? currentProject.icon : null);
 
+  populateProjectSessionVisibilitySettings(currentSlug, currentProject);
+
   // Owner (only in multi-user mode)
   var ownerField = document.getElementById("ps-owner-field");
   if (ownerField) {

package/lib/public/modules/sidebar-projects.js

@@ -1,7 +1,7 @@
 // sidebar-projects.js - Project icon strip, context menus, emoji picker, drag-and-drop, worktree modal
 // Extracted from sidebar.js (PR-36)
 
-import { escapeHtml } from './utils.js';
+import { escapeHtml, showToast } from './utils.js';
 import { iconHtml, refreshIcons } from './icons.js';
 import { openProjectSettings } from './project-settings.js';
 import { triggerShare } from './qrcode.js';
@@ -415,6 +415,11 @@ function showProjectCtxMenu(anchorEl, slug, name, icon, position) {
   closeProjectCtxMenu();
   if (closeUserCtxMenu) closeUserCtxMenu();
   closeEmojiPicker();
+  var projects = getCachedProjects();
+  var targetProject = null;
+  for (var projectIndex = 0; projectIndex < projects.length; projectIndex++) {
+    if (projects[projectIndex].slug === slug) { targetProject = projects[projectIndex]; break; }
+  }
 
   var menu = document.createElement("div");
   menu.className = "project-ctx-menu";
@@ -438,7 +443,13 @@ function showProjectCtxMenu(anchorEl, slug, name, icon, position) {
     settingsItem.addEventListener("click", function (e) {
       e.stopPropagation();
       closeProjectCtxMenu();
-      openProjectSettings(slug, { slug: slug, name: name, icon: icon, projectOwnerId: store.get('currentProjectOwnerId'), ownerLocked: store.get('ownerLocked') });
+      if (!targetProject) {
+        showToast("Project details are unavailable. Refresh and try again.", "error");
+        return;
+      }
+      openProjectSettings(slug, Object.assign({}, targetProject, {
+        name: targetProject.title || targetProject.project || name,
+      }));
     });
     menu.appendChild(settingsItem);
   }
@@ -460,7 +471,7 @@ function showProjectCtxMenu(anchorEl, slug, name, icon, position) {
 
   // --- Manage Access ---
   if (store.get('isMultiUserMode')) {
-    var isProjectOwner = store.get('myUserId') && store.get('currentProjectOwnerId') && store.get('myUserId') === store.get('currentProjectOwnerId');
+    var isProjectOwner = store.get('myUserId') && targetProject && targetProject.projectOwnerId && store.get('myUserId') === targetProject.projectOwnerId;
     var isAdmin = store.get('permissions') && store.get('permissions').projectSettings !== false;
     if (isProjectOwner || isAdmin) {
       var accessItem = document.createElement("button");

package/lib/server.js

@@ -158,6 +158,7 @@ function createServer(opts) {
   var onReorderProjects = opts.onReorderProjects || null;
   var onSetProjectTitle = opts.onSetProjectTitle || null;
   var onSetProjectIcon = opts.onSetProjectIcon || null;
+  var onSetProjectSessionVisibilityDefault = opts.onSetProjectSessionVisibilityDefault || null;
   var onProjectOwnerChanged = opts.onProjectOwnerChanged || null;
   var onGetServerDefaultEffort = opts.onGetServerDefaultEffort || null;
   var onSetServerDefaultEffort = opts.onSetServerDefaultEffort || null;
@@ -1458,6 +1459,7 @@ function createServer(opts) {
       onReorderProjects: onReorderProjects,
       onSetProjectTitle: onSetProjectTitle,
       onSetProjectIcon: onSetProjectIcon,
+      onSetProjectSessionVisibilityDefault: onSetProjectSessionVisibilityDefault,
       onProjectOwnerChanged: onProjectOwnerChanged,
       onGetServerDefaultEffort: onGetServerDefaultEffort,
       onSetServerDefaultEffort: onSetServerDefaultEffort,
@@ -1707,7 +1709,12 @@ function createServer(opts) {
     var visible = [];
     projects.forEach(function (ctx, slug) {
       if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, slug))) return;
-      visible.push(ctx.getStatus());
+      var status = ctx.getStatus();
+      if (!status.isMate && onGetProjectAccess) {
+        var access = onGetProjectAccess(slug);
+        status.sessionVisibilityDefault = access && access.sessionVisibilityDefault === "shared" ? "shared" : "private";
+      }
+      visible.push(status);
     });
     return visible;
   }

package/lib/session-visibility.js

@@ -7,6 +7,66 @@ function restore(meta) {
   return meta.sessionVisibilityExplicit === true ? normalize(meta.sessionVisibility) : "private";
 }
 
+function defaultForProject(access) {
+  return access && access.sessionVisibilityDefault === "shared" ? "shared" : "private";
+}
+
+function resolveNewSessionVisibility(access, msg, isMate) {
+  if (isMate === true) return { visibility: "private" };
+  if (!msg || !Object.prototype.hasOwnProperty.call(msg, "sessionVisibility")) {
+    return { visibility: defaultForProject(access) };
+  }
+  if (msg.sessionVisibility === "private" || msg.sessionVisibility === "shared") {
+    return { visibility: msg.sessionVisibility };
+  }
+  return { error: "Session visibility must be private or shared." };
+}
+
+function defaultChangeResult(ctx, ws, msg, result) {
+  var requestedSlug = typeof msg.slug === "string" && msg.slug.length > 0 && msg.slug.length <= 200 ? msg.slug : ctx.slug;
+  ctx.sendTo(ws, Object.assign({
+    type: "set_project_session_visibility_default_result",
+    slug: requestedSlug,
+    requestId: typeof msg.requestId === "string" ? msg.requestId.substring(0, 200) : null,
+  }, result));
+}
+
+function handleDefaultChange(ctx, ws, msg) {
+  if (!msg || (msg.visibility !== "shared" && msg.visibility !== "private")) {
+    defaultChangeResult(ctx, ws, msg || {}, { ok: false, error: "Session visibility default must be private or shared." });
+    return true;
+  }
+  if (msg.slug && msg.slug !== ctx.slug) {
+    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Project settings access is not permitted" });
+    return true;
+  }
+  if (ctx.isMate === true || !ctx.usersModule || !ctx.usersModule.isMultiUser || !ctx.usersModule.isMultiUser()) {
+    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Not supported" });
+    return true;
+  }
+  var user = ws && ws._clayUser && ctx.usersModule.findUserById(ws._clayUser.id);
+  var access = ctx.getProjectAccess ? ctx.getProjectAccess() : null;
+  if (access && access.isWorktree === true) {
+    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Worktrees inherit this setting from their parent project." });
+    return true;
+  }
+  var permissions = user && ctx.usersModule.getEffectivePermissions
+    ? ctx.usersModule.getEffectivePermissions(user, ctx.osUsers) : {};
+  var isOwner = !!(user && access && access.ownerId && access.ownerId === user.id);
+  var isAdmin = !!(user && user.role === "admin");
+  if (!user || !permissions.projectSettings || (!isOwner && !isAdmin)) {
+    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Project settings access is not permitted" });
+    return true;
+  }
+  if (typeof ctx.opts.onSetProjectSessionVisibilityDefault !== "function") {
+    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Not supported" });
+    return true;
+  }
+  var result = ctx.opts.onSetProjectSessionVisibilityDefault(ctx.slug, msg.visibility);
+  defaultChangeResult(ctx, ws, msg, { ok: !!(result && result.ok), visibility: result && result.visibility, error: result && result.error });
+  return true;
+}
+
 function handleChange(ctx, ws, msg) {
   if (typeof msg.sessionId !== "number" || (msg.visibility !== "shared" && msg.visibility !== "private")) return;
   var session = ctx.sm.sessions.get(msg.sessionId);
@@ -38,4 +98,5 @@ function revokeViewers(ctx, session) {
   }
 }
 
-module.exports = { normalize: normalize, restore: restore, handleChange: handleChange, revokeViewers: revokeViewers };
+module.exports = { normalize: normalize, restore: restore, defaultForProject: defaultForProject, resolveNewSessionVisibility: resolveNewSessionVisibility,
+  handleChange: handleChange, handleDefaultChange: handleDefaultChange, revokeViewers: revokeViewers };

package/lib/sessions.js

@@ -1100,6 +1100,8 @@ function createSessionManager(opts) {
       lastActivity: Date.now(),
       history: cliHistory,
       messageUUIDs: [],
+      sessionVisibility: sessionVisibility.normalize(opts && opts.sessionVisibility),
+      sessionVisibilityExplicit: !!(opts && opts.sessionVisibilityExplicit === true),
       bookmarked: false,
       favoriteOrder: null,
     };

package/lib/ws-schema.js

@@ -27,6 +27,8 @@ var schema = {
   "reorder_session_bookmarks": { direction: "c2s", handler: "lib/project-sessions.js", description: "Reorder favorited sessions within the favorites area" },
   "bulk_delete_sessions":    { direction: "c2s", handler: "lib/project-sessions.js", description: "Delete a group of sessions at once" },
   "set_session_visibility":   { direction: "c2s", handler: "lib/project-sessions.js", description: "Show or hide a session in the sidebar" },
+  "set_project_session_visibility_default": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set private/shared default for new ordinary project sessions" },
+  "set_project_session_visibility_default_result": { direction: "s2c", handler: "lib/public/modules/project-session-visibility-settings.js", description: "Correlated project session visibility default update result" },
   "search_sessions":          { direction: "c2s", handler: "lib/project-sessions.js", description: "Search session titles" },
   "search_session_content":   { direction: "c2s", handler: "lib/project-sessions.js", description: "Full-text search within a session" },
   "load_more_history":        { direction: "c2s", handler: "lib/project-sessions.js", description: "Request older history entries for the current session" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.1.0",
+  "version": "4.2.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"