clay-server 5.0.2-beta.1 → 5.1.0-beta.1

package/lib/project-file-path.js

@@ -12,9 +12,8 @@ function inside(base, target) {
   return relative !== ".." && !relative.startsWith(".." + path.sep) && !path.isAbsolute(relative);
 }
 
-// Scope is server-derived for each request. In personal and mapped OS-user
-// modes, the actual filesystem operation enforces read/write permissions.
-// Unmapped multi-user deployments retain the project and symlink boundary.
+// Scope is server-derived for each request. File-viewer operations follow the
+// executing OS identity within the account-derived project boundary, if any.
 function resolveFilePath(cwd, requested, scope) {
   if (typeof requested !== "string" || !requested || requested.indexOf("\0") !== -1) {
     throw failure("INVALID_PATH", "Invalid file path");

package/lib/project-request-access.js

@@ -60,10 +60,22 @@ function attachRequestAccess(ctx) {
     return info;
   }
 
+  function isSoleAccount(ws) {
+    if (!users || typeof users.getAllUsers !== "function") return false;
+    try {
+      var accounts = users.getAllUsers();
+      var user = userFor(ws);
+      return !!(user && user.id && Array.isArray(accounts) && accounts.length === 1 &&
+        accounts[0] && accounts[0].id === user.id);
+    } catch (e) { return false; }
+  }
+
   function fileScope(ws) {
     if (!canUseFiles(ws)) throw fileFailure("FILE_FORBIDDEN", "File browser access is not permitted");
     var identity = osIdentity(ws);
-    return { identity: identity, projectBound: isMultiUser() && !identity };
+    // Recheck the account roster so adding another user restores the boundary
+    // for shared installations without OS isolation, including active watches.
+    return { identity: identity, projectBound: !identity && isMultiUser() && !isSoleAccount(ws) };
   }
 
   return { permitMessage: permitMessage, canAccessProject: canAccessProject, hasPermission: hasPermission,

package/lib/public/css/filebrowser.css

@@ -1696,6 +1696,16 @@
   padding: 0;
 }
 
+.file-viewer-html-preview {
+  display: block;
+  width: 100%;
+  height: 100%;
+  min-height: 320px;
+  border: 0;
+  background: #fff;
+  color-scheme: light;
+}
+
 .file-viewer-body pre {
   margin: 0;
   padding: 16px 20px;

package/lib/public/modules/filebrowser.js

@@ -13,6 +13,7 @@ import { initFileViewerTabs, openFileViewerTab, previewFileViewerTab, updateFile
 import { initFileBrowserContextMenu, downloadProjectFile } from './filebrowser-context-menu.js';
 import { registerClayFileLinkOpener } from './clay-file-links.js';
 import { isPlantUmlFile, renderPlantUmlPreview, cancelPlantUmlPreview } from './plantuml-preview.js';
+import { isHtmlFile, renderHtmlPreview } from './html-preview.js';
 
 var ctx;
 var showDropHint = function () {};
@@ -43,7 +44,7 @@ export function initFileBrowser(_ctx) {
     onFocus: function(path) {
       claimRightWorkbench("file-viewer");
       ctx.fileViewerEl.classList.remove("hidden");
-      if (path !== currentFilePath) requestFileContent(path);
+      if (path !== currentFilePath || (store.get("fileViewerIsHtml") && isRendered && !document.querySelector(".file-viewer-html-preview"))) requestFileContent(path);
     },
     onEmpty: function() { teardownFileViewer(); },
   });
@@ -194,10 +195,14 @@ export function initFileBrowser(_ctx) {
     downloadProjectFile(currentFilePath);
   });
 
-  // Markdown render toggle
+  // File preview/source toggle
   document.getElementById("file-viewer-render").addEventListener("click", function () {
-    if (currentContent == null || (!currentIsMarkdown && !currentIsSvg && !store.get("fileViewerIsPlantUml"))) return;
+    if (currentContent == null || (!currentIsMarkdown && !currentIsSvg && !store.get("fileViewerIsPlantUml") && !store.get("fileViewerIsHtml"))) return;
     isRendered = !isRendered;
+    if (store.get("fileViewerIsHtml")) {
+      renderHtmlBody();
+      return;
+    }
     if (store.get("fileViewerIsPlantUml")) {
       renderPlantUmlBody();
       return;
@@ -491,6 +496,8 @@ export function closeFileViewer() {
 
 function teardownFileViewer() {
   cancelPlantUmlPreview();
+  var htmlFrame = document.querySelector(".file-viewer-html-preview");
+  if (htmlFrame) htmlFrame.remove();
   if (currentFilePath && isFollowingMarkdown(currentFilePath)) cancelMarkdownFollow();
   sendUnwatch();
   inlineDiffActive = false;
@@ -528,7 +535,7 @@ export function resetFileBrowser() {
   isRendered = false;
   currentIsMarkdown = false;
   currentIsSvg = false;
-  store.set({ fileViewerIsPlantUml: false });
+  store.set({ fileViewerIsPlantUml: false, fileViewerIsHtml: false });
   cancelPlantUmlPreview();
   historyVisible = false;
   currentHistoryEntries = [];
@@ -1165,7 +1172,7 @@ function showFileContent(msg, expectedRevision) {
   currentFilePath = msg.path;
   currentIsMarkdown = false;
   currentIsSvg = false;
-  store.set({ fileViewerIsPlantUml: false });
+  store.set({ fileViewerIsPlantUml: false, fileViewerIsHtml: false });
   cancelPlantUmlPreview();
   if (!keepRenderState) isRendered = false;
   var requestedExt = msg.path.split(".").pop().toLowerCase();
@@ -1193,19 +1200,20 @@ function showFileContent(msg, expectedRevision) {
     lightweightPreview = (msg.size || 0) > FILE_RICH_PREVIEW_MAX_BYTES;
     currentIsMarkdown = !lightweightPreview && (ext === "md" || ext === "mdx");
     currentIsSvg = !lightweightPreview && ext === "svg";
+    store.set({ fileViewerIsHtml: !lightweightPreview && isHtmlFile(msg.path) });
     store.set({ fileViewerIsPlantUml: !lightweightPreview && isPlantUmlFile(msg.path) });
     if (lightweightPreview) isRendered = false;
     if (pendingRenderedOpen && currentIsMarkdown) isRendered = true;
 
-    if (currentIsMarkdown || currentIsSvg || store.get("fileViewerIsPlantUml")) {
+    if (currentIsMarkdown || currentIsSvg || store.get("fileViewerIsPlantUml") || store.get("fileViewerIsHtml")) {
       renderBtn.classList.remove("hidden");
       renderBtn.title = currentIsSvg ? "Show SVG source" : "Render markdown";
-      copyBtn.title = store.get("fileViewerIsPlantUml") ? "Copy PlantUML source" : currentIsSvg ? "Copy SVG source" : "Copy Markdown source";
+      copyBtn.title = store.get("fileViewerIsHtml") ? "Copy HTML source" : store.get("fileViewerIsPlantUml") ? "Copy PlantUML source" : currentIsSvg ? "Copy SVG source" : "Copy Markdown source";
     } else {
       copyBtn.title = "Copy contents";
     }
 
-    // Markdown starts as source; SVG starts as a safe image preview.
+    // Markdown starts as source; HTML, SVG and diagrams start as previews.
     if (lightweightPreview) {
       renderLargeTextFile(bodyEl, msg.content, msg.size);
     } else if (currentIsMarkdown) {
@@ -1214,6 +1222,9 @@ function showFileContent(msg, expectedRevision) {
         ? (previousContent == null ? "" : previousContent)
         : null;
       renderBody(transitionFrom, refreshSlideIndex);
+    } else if (store.get("fileViewerIsHtml")) {
+      if (!keepRenderState) isRendered = !store.get("pendingFileNavigation");
+      renderHtmlBody();
     } else if (store.get("fileViewerIsPlantUml")) {
       if (!keepRenderState) isRendered = !store.get("pendingFileNavigation");
       renderPlantUmlBody();
@@ -1283,6 +1294,15 @@ function showFileContent(msg, expectedRevision) {
   }
 }
 
+function renderHtmlBody() {
+  var bodyEl = document.getElementById("file-viewer-body");
+  var renderBtn = document.getElementById("file-viewer-render");
+  renderBtn.classList.toggle("active", isRendered);
+  renderBtn.title = isRendered ? "Show HTML source" : "Show HTML preview";
+  if (isRendered) renderHtmlPreview(bodyEl, currentContent, currentFilePath);
+  else renderCodeWithLineNumbers(bodyEl, currentContent, "html");
+}
+
 function renderPlantUmlBody() {
   var bodyEl = document.getElementById("file-viewer-body");
   var renderBtn = document.getElementById("file-viewer-render");

package/lib/public/modules/html-preview.js

@@ -0,0 +1,19 @@
+export function isHtmlFile(path) {
+  return /\.html?$/i.test(String(path || ""));
+}
+
+export function renderHtmlPreview(body, source, path) {
+  var frame = document.createElement("iframe");
+  frame.className = "file-viewer-html-preview";
+  frame.title = "HTML preview of " + path;
+  // Scripts can drive the preview, but cannot access Clay's document or cookies.
+  frame.setAttribute("sandbox", "allow-scripts");
+  frame.setAttribute("referrerpolicy", "no-referrer");
+  var doc = new DOMParser().parseFromString(source, "text/html");
+  var policy = doc.createElement("meta");
+  policy.httpEquiv = "Content-Security-Policy";
+  policy.content = "default-src 'none'; script-src 'unsafe-inline' https: http:; style-src 'unsafe-inline' https: http:; img-src data: blob: https: http:; font-src data: https: http:; media-src data: blob: https: http:; connect-src 'none'; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'";
+  doc.head.prepend(policy);
+  frame.srcdoc = "<!doctype html>\n" + doc.documentElement.outerHTML;
+  body.replaceChildren(frame);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "5.0.2-beta.1",
+  "version": "5.1.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"