@mirrowel/opencode-openshare 0.2.0-dev.1 → 0.2.0-dev.2

package/dist/v2-server.js

@@ -177,7 +177,20 @@ export function createV2ServerSetup() {
         // the client adapter and feed them into the engine as the v1 events it
         // understands (session.updated / message.updated / message.part.updated).
         // The engine's keyed queue makes repeated re-syncs idempotent.
+        // NOTE: no content-hash dedupe here — a refresh that runs while the
+        // session is still dormant (pre-flag) would poison the cache without
+        // emitting anything, and the flag-time refresh would then SKIP the
+        // unchanged messages (live-caught in the v2 mock suite: the share's
+        // first assistant content arrived only as the next change). The dedupe
+        // belongs engine-side, where dormancy is known, if it's ever needed.
         const pendingRefresh = new Map();
+        // queued inbox inputs per session: v2 persists the prompt in the inbox
+        // (delivery "queue") while the current turn still runs — the message
+        // row can exist before the model ever sees it, and a mid-turn refresh
+        // would surface it early. Held here until session.inbox.delivered
+        // fires (the turn actually starts); "steer" inputs inject into the
+        // live run, so they pass straight through.
+        const queuedInbox = new Map();
         const refresh = (sessionID) => {
             let timer = pendingRefresh.get(sessionID);
             if (timer)
@@ -192,7 +205,10 @@ export function createV2ServerSetup() {
                         });
                         const messages = await client.session.messages?.({ path: { id: sessionID } });
                         const list = (messages?.data ?? []);
+                        const held = queuedInbox.get(sessionID);
                         for (const message of list) {
+                            if (held?.has(message.info.id))
+                                continue; // still queued — not sent to the model yet
                             await engine.hooks.event({
                                 event: { type: "message.updated", properties: { sessionID, info: message.info } },
                             });
@@ -228,6 +244,45 @@ export function createV2ServerSetup() {
                             await engine.hooks.event({ event: { type, properties: { sessionID: sid } } });
                             continue;
                         }
+                        if (type.startsWith("session.inbox.")) {
+                            // queued-prompt lifecycle: hold delivery="queue" inputs off
+                            // the share until they are actually delivered to the model
+                            // (cancelled ones never appear). inboxID shares the message
+                            // id space (the inbox item promotes into that message row).
+                            const data = (event.data ?? {});
+                            const inboxID = data.inboxID;
+                            if (inboxID) {
+                                let set = queuedInbox.get(sid);
+                                if (!set) {
+                                    set = new Set();
+                                    queuedInbox.set(sid, set);
+                                }
+                                if (type === "session.inbox.enqueued" && data.item?.delivery === "queue") {
+                                    set.add(inboxID);
+                                }
+                                else if (type === "session.inbox.delivered") {
+                                    set.delete(inboxID);
+                                    refresh(sid); // the held prompt's turn is starting now
+                                }
+                                else if (type === "session.inbox.cancelled") {
+                                    // cancelled-before-run: the prompt never reaches the
+                                    // model — keep it held forever so no later refresh
+                                    // surfaces the orphaned row
+                                    set.add(inboxID);
+                                }
+                                else if (type === "session.inbox.delivery.changed") {
+                                    // steer inputs inject into the live run — the model
+                                    // sees them; only "queue" holds
+                                    if (data.item?.delivery === "queue")
+                                        set.add(inboxID);
+                                    else {
+                                        set.delete(inboxID);
+                                        refresh(sid);
+                                    }
+                                }
+                            }
+                            continue;
+                        }
                         if (type === "message.removed" || type === "message.part.removed") {
                             // undo cleanup: forwarded verbatim — the engine emits the
                             // tombstones that purge the reverted items from the share

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mirrowel/opencode-openshare",
-  "version": "0.2.0-dev.1",
+  "version": "0.2.0-dev.2",
   "type": "module",
   "description": "Open(code)Share — re:share: self-hosted session sharing for opencode. Server plugin (single file or package), optional TUI for interactive opt-in sharing.",
   "license": "MIT",

package/src/binding-queue.ts

@@ -0,0 +1,26 @@
+/** Serialize session-metadata binding writes.
+ *
+ * Two writers read-modify-write `metadata.openshare` on the same session:
+ * the engine (`writeMetadata` in core.ts — preserves foreign keys, sets
+ * the servers map) and the TUI (`patchSessionBinding` in share-flow.ts —
+ * opt-outs, collision resolution). Their PATCHes interleave at the host:
+ * writer A reads at T0, writer B reads at T1, A PATCHes at T2, B PATCHes
+ * at T3 — A's change is silently lost (live-caught class: a TUI opt-out
+ * erased by the engine's binding refresh).
+ *
+ * Both route their whole read-modify-write through this per-session FIFO.
+ * The queue never breaks on errors; entries drop when the process exits.
+ */
+const queues = new Map<string, Promise<unknown>>()
+
+export function queueBindingWrite<T>(sid: string, fn: () => Promise<T>): Promise<T> {
+  const prev = queues.get(sid) ?? Promise.resolve()
+  // run regardless of the previous slot's outcome — one failed write must
+  // not wedge the session's binding updates forever
+  const run = prev.then(fn, fn)
+  queues.set(
+    sid,
+    run.catch(() => {}),
+  )
+  return run
+}

package/src/commands.ts

@@ -1,8 +1,9 @@
 // OpenShare command registration. ONE user-facing /share command shadows
 // the deprecated built-in (opncd.ai) by registering the same command name
-// on a plugin keymap layer; running it on a shared session opens the
-// share manager (copy link / stop sharing) instead — you can't share
-// twice, so /share is a toggle. /openshare opens settings.
+// on a plugin keymap layer. Running it on a shared session opens the SAME
+// session menu as /openshare → This session (copy / stop / TTL / read
+// auth — one surface, no duplicated manager); on an unshared session it
+// asks consent and creates the share. /openshare opens settings.
 //
 // LAYER SHAPE (live-caught 2026-10-19): the v1 host keymap gates layers
 // that declare `mode` on the mode stack (resting mode is "base"), so a
@@ -14,21 +15,16 @@
 // deliberately NOT joined into the shared family palette category).
 
 import {
-  CONSENT_KV_KEY,
   clearGoneBindingEntries,
-  confirmShare,
   currentConfig,
-  isConfigured,
   hostOf,
+  isConfigured,
   patchSessionBinding,
-  readBinding,
   readBindings,
   resolveRoot,
-  runShareFlow,
   runUnshareFlow,
-  serverEntries,
+  shareWithConsent,
   verifyShare,
-  workerDeleteShare,
 } from "./share-flow.js"
 import { onboardingDialog, settingsDialog } from "./settings.js"
 import { dbgLog } from "./sidebar.js"
@@ -51,30 +47,28 @@ function finish(host: ShareHostApi, result: { ok: boolean; message: string; url?
   })
 }
 
-/** The already-shared state: per-server management for the fan-out era.
- * Single binding keeps the compact classic menu; multiple bindings get a
- * per-server submenu (copy / stop here / leave as-is) plus all-stop.
- * Opens with a liveness sweep: bindings whose page died server-side
- * (purge/TTL/delete) are auto-cleared and surfaced in a gone modal. */
-async function showShareManager(host: ShareHostApi, sessionID: () => string | undefined) {
-  const sid = sessionID()
-  if (!sid) return
-  const root = await resolveRoot(host.client, sid)
+/** Shared pre-menu pass: collision check + liveness sweep. Bindings whose
+ * page died server-side (purge/TTL/delete) are auto-cleared and surfaced
+ * in a gone modal offering a re-share. Returns null when a dialog flow
+ * took over (collision / re-share) and already finished; otherwise the
+ * surviving bindings and whether any gone modal was shown. */
+async function sweepBindings(host: ShareHostApi, sid: string, root: string) {
   let all = await readBindings(host.client, root)
+  let goneShown = false
 
   // collision first: the engine marked a server's credentials as rejected
   const collided = all.find((b) => b.collided)
-  if (collided) return showCollisionDialog(host, root, collided.server, collided.id, collided.collided ?? "")
+  if (collided) {
+    await showCollisionDialog(host, root, collided.server, collided.id, collided.collided ?? "")
+    return null
+  }
 
-  // liveness sweep: probe every live-bound server (credential-free /data
-  // check). GONE entries are removed from the binding automatically; the
-  // modal says what happened and offers to re-share. Network errors are
-  // "unknown" and never treated as gone.
   const live = all.filter((b) => b.url && b.enabled !== false && b.id)
   if (live.length) {
     const verdicts = await Promise.all(live.map((b) => verifyShare(b.server, b.id)))
     const gone = live.filter((b, i) => verdicts[i] === "gone")
     if (gone.length) {
+      goneShown = true
       await clearGoneBindingEntries(host, root, gone.map((b) => b.server))
       all = all.filter((b) => !gone.some((g) => g.server === b.server))
       const list = gone.map((b) => `• ${hostOf(b.url || b.server)} — ${b.url}`).join("\n")
@@ -87,235 +81,15 @@ async function showShareManager(host: ShareHostApi, sessionID: () => string | un
         ],
       })
       if (choice === "again") {
-        finish(host, await runShareFlow(host, sid))
-        return
+        finish(host, await shareWithConsent(host, sid))
+        return null
       }
-      if (all.length === 0) return
-    }
-  }
-
-  if (all.length === 0) return
-
-  const otherServers = serverEntries().filter((s) => !all.some((b) => b.server === s.url))
-
-  if (all.length === 1 && otherServers.length === 0) {
-    // the classic single-server menu
-    const b = all[0]
-    void host.ui
-      .showMenu<string>({
-        title: "Session is shared",
-        hint: b.url,
-        options: [
-          {
-            title: "Copy share link",
-            value: "copy",
-            description: "copy the share URL to the clipboard",
-            help: `Copies the share URL to the clipboard (navigator + OSC52 fallback).\n\nURL: ${b.url}\nServer: ${b.server}\nShare id: ${b.id}\n\nAnyone with the link can read the page (plus the login, if read auth is set).`,
-          },
-          {
-            title: "Stop sharing",
-            value: "stop",
-            description: "Delete the share page — the link stops working for everyone",
-            help: `Deletes the page on ${hostOf(b.url || b.server)} server-side and clears this session's share flag. Viewers with the link see a final "gone" state. This cannot be undone — sharing again creates a NEW page with a new URL.`,
-          },
-          { title: "Cancel", value: "cancel" },
-        ],
-      })
-      .then(async (choice) => {
-        if (choice === "copy") {
-          const ok = await host.clipboard.write(b.url)
-          finish(host, ok ? { ok: true, message: `Share URL copied to clipboard: ${b.url}`, url: b.url } : { ok: false, message: `Could not write the clipboard — link: ${b.url}`, url: b.url })
-          return
-        }
-        if (choice === "stop") {
-          const how = await host.ui.showMenu<string>({
-            title: "Stop sharing",
-            hint: b.url,
-            options: [
-              {
-                title: "Delete the page",
-                value: "delete",
-                description: "the link stops working for everyone",
-                danger: true,
-                help: `Deletes the page on ${hostOf(b.url || b.server)} and clears this session's share flag. Viewers with the link see a final "gone" state. Sharing again later creates a fresh page with a new URL.`,
-              },
-              {
-                title: "Leave as-is (snapshot)",
-                value: "leave",
-                description: "stop updating; the page stays until its TTL",
-                help: `Stops mirroring WITHOUT deleting anything — viewers keep reading the snapshot until the share's TTL expires. Useful for handing someone a frozen copy while you keep working.`,
-              },
-              { title: "Cancel", value: "cancel" },
-            ],
-          })
-          if (!how || how === "cancel") return
-          if (how === "leave") {
-            await patchSessionBinding(host.client, root, (servers) => {
-              delete servers[b.server]
-              servers[b.server] = { optedOut: true }
-            })
-            finish(host, { ok: true, message: `${hostOf(b.url || b.server)} left as-is — a snapshot until its TTL.` })
-            return
-          }
-          const yes = await host.ui.showConfirm({
-            title: "Delete the share page",
-            message: `Delete the page on ${hostOf(b.url || b.server)}?\nThe link stops working for everyone.`,
-            confirmLabel: "Delete",
-            danger: true,
-          })
-        if (!yes) {
-          host.ui.dialog.clear()
-          return
-        }
-          finish(host, await runUnshareFlow(host, sessionID()))
-        }
-      })
-    return
-  }
-
-  // fan-out menu
-  const options: Array<{ title: string; value: string; description?: string; help?: string; danger?: boolean }> = all.map((b) => ({
-    title: `Copy link — ${hostOf(b.url || b.server)}`,
-    value: `copy:${b.server}`,
-    description: b.url,
-    help: `Copies this server's share URL to the clipboard.\n\nURL: ${b.url}\nServer: ${b.server}\nShare id: ${b.id}\n\nEach server carries an independent page of the same session.`,
-  }))
-  options.push({
-    title: "Manage per server…",
-    value: "manage",
-    description: `${all.length} servers — stop one, leave a snapshot`,
-    help: `Per-server actions: copy the link, stop sharing there (page deleted), or leave it as a read-only snapshot (updates stop, the page lives out its TTL). Other servers are unaffected.\n\nBound servers:\n${all.map((b) => `• ${b.server} — ${b.url}`).join("\n")}`,
-  })
-  if (otherServers.length) {
-    options.push({
-      title: "Share to another server…",
-      value: "more",
-      description: otherServers.map((s) => hostOf(s.url)).join(", "),
-      help: `Adds one of your other configured servers as a destination for THIS session: it becomes the active server and the full history is mirrored there within seconds.\n\nAvailable:\n${otherServers.map((s) => `• ${s.url}`).join("\n")}`,
-    })
-  }
-  options.push({
-    title: "Stop sharing (all)",
-    value: "stop-all",
-    description: "delete every server's page, or leave snapshots",
-    danger: true,
-    help: `Deletes the page on all ${all.length} servers (or leaves them as read-only snapshots — your choice on the next screen) and clears the share flag. Sharing again creates fresh pages.`,
-  })
-  options.push({ title: "Cancel", value: "cancel" })
-  const choice = await host.ui.showMenu<string>({ title: `Session is shared · ${all.length} servers`, options })
-  if (!choice || choice === "cancel") return
-  if (choice.startsWith("copy:")) {
-    const b = all.find((x) => `copy:${x.server}` === choice)
-    if (b) {
-      const ok = await host.clipboard.write(b.url)
-      finish(host, ok ? { ok: true, message: `Share URL copied: ${b.url}`, url: b.url } : { ok: false, message: `Clipboard failed — ${b.url}`, url: b.url })
-    }
-    return
-  }
-  if (choice === "stop-all") {
-    const how = await host.ui.showMenu<string>({
-      title: `Stop sharing · ${all.length} servers`,
-      options: [
-        { title: "Delete every page", value: "delete", description: "all links stop working", danger: true, help: `Deletes the page on every bound server (${all.map((b) => hostOf(b.url || b.server)).join(", ")}) and clears the share flag.` },
-        { title: "Leave all as-is (snapshots)", value: "leave", description: "stop updating; pages stay until their TTLs", help: `Stops mirroring everywhere without deleting anything — every page stays readable as a frozen snapshot until its TTL expires.` },
-        { title: "Cancel", value: "cancel" },
-      ],
-    })
-    if (!how || how === "cancel") return
-    if (how === "leave") {
-      await patchSessionBinding(host.client, root, (servers) => {
-        for (const b of all) {
-          delete servers[b.server]
-          servers[b.server] = { optedOut: true }
-        }
-      })
-      finish(host, { ok: true, message: `${all.length} server(s) left as-is — snapshots until their TTLs.` })
-      return
-    }
-    const yes = await host.ui.showConfirm({
-      title: "Stop sharing",
-      message: `Delete the share pages on all ${all.length} servers? The links stop working for everyone.`,
-      confirmLabel: "Stop all",
-      danger: true,
-    })
-    if (!yes) return
-    finish(host, await runUnshareFlow(host, sessionID()))
-    return
-  }
-  if (choice === "more") {
-    const pick = await host.ui.showMenu<string>({
-      title: "Share to another server",
-      options: [...otherServers.map((s) => ({ title: hostOf(s.url), value: s.url, description: s.entry.label })), { title: "Cancel", value: "__cancel" }],
-    })
-    if (!pick || pick === "__cancel") return
-    const { saveServerEntry } = await import("./share-flow.js")
-    for (const s of serverEntries()) if (s.url !== pick) saveServerEntry(s.url, { active: undefined })
-    saveServerEntry(pick, { active: true })
-    finish(host, { ok: true, message: `${hostOf(pick)} activated — this session mirrors there within seconds (new sessions share to it too).` })
-    return
-  }
-  if (choice === "manage") {
-    const pick = await host.ui.showMenu<string>({
-      title: "Manage server",
-      options: [...all.map((b) => ({ title: hostOf(b.url || b.server), value: b.server, description: b.url })), { title: "Cancel", value: "__cancel" }],
-    })
-    if (!pick || pick === "__cancel") return
-    const b = all.find((x) => x.server === pick)
-    if (!b) return
-    const action = await host.ui.showMenu<string>({
-      title: `${hostOf(b.url || b.server)}`,
-      hint: b.url,
-      options: [
-        {
-          title: "Copy link",
-          value: "copy",
-          description: "copy the share URL",
-          help: `Copies this server's share URL to the clipboard.\n\nURL: ${b.url}\nShare id: ${b.id}`,
-        },
-        {
-          title: "Stop sharing here",
-          value: "stop",
-          description: "delete THIS server's page; other servers unaffected",
-          help: `Deletes the page on ${hostOf(b.url || b.server)} and retires this server for the session (the engine stops mirroring here). Other servers keep streaming. Sharing here again later creates a new page.`,
-        },
-        {
-          title: "Leave as-is (snapshot)",
-          value: "leave",
-          description: "stop updating it; the page stays until its TTL",
-          help: `Stops mirroring to ${hostOf(b.url || b.server)} WITHOUT deleting anything — viewers keep reading the snapshot until the share's TTL expires. Useful for handing someone a frozen copy while you keep working.`,
-        },
-        { title: "Cancel", value: "cancel" },
-      ],
-    })
-    if (!action || action === "cancel") return
-    if (action === "copy") {
-      const ok = await host.clipboard.write(b.url)
-      finish(host, ok ? { ok: true, message: `Share URL copied: ${b.url}`, url: b.url } : { ok: false, message: `Clipboard failed — ${b.url}`, url: b.url })
-      return
-    }
-    if (action === "stop") {
-      const deleted = await workerDeleteShare(b.server || b.url.slice(0, b.url.indexOf("/s/")), b.id, b.secret)
-      await patchSessionBinding(host.client, root, (servers) => {
-        delete servers[b.server]
-        servers[b.server] = { optedOut: true }
-      })
-      finish(host, { ok: true, message: deleted ? `Stopped sharing on ${hostOf(b.url || b.server)} — page deleted.` : `Stopped sharing on ${hostOf(b.url || b.server)} (page deletion follows via the sweeper).` })
-      return
-    }
-    if (action === "leave") {
-      await patchSessionBinding(host.client, root, (servers) => {
-        delete servers[b.server]
-        servers[b.server] = { optedOut: true }
-      })
-      finish(host, { ok: true, message: `${hostOf(b.url || b.server)} left as-is — a snapshot until its TTL.` })
-      return
+      if (all.length === 0) return { all, goneShown }
     }
   }
+  return { all, goneShown }
 }
 
-/** Credential collision: the engine refused to auto-recreate. The user
- * chooses: copy debug info (for the hoster/issue), share on a new share,
- * or don't share. */
 async function showCollisionDialog(host: ShareHostApi, root: string, server: string, shareId: string, error: string) {
   const debugInfo = JSON.stringify({ server, shareId, error, sessionID: root, plugin: "openshare", time: new Date().toISOString() }, null, 2)
   const choice = await host.ui.showMenu<string>({
@@ -388,41 +162,28 @@ export function buildShareCommand(host: ShareHostApi, sessionID: () => string |
         return
       }
       const root = await resolveRoot(host.client, sid)
-      const bindings = await readBindings(host.client, root)
-      const binding = bindings[0]
-      dbgLog(`/share gate: sid=${sid} root=${root} bindings=${bindings.length}`)
+      // collision + gone sweep, then the gate. null = a dialog flow took
+      // over (collision / gone re-share) and already finished.
+      const swept = await sweepBindings(host, sid, root)
+      if (swept === null) return
+      const { all, goneShown } = swept
       // live ⇔ url && enabled !== false (all-mode bindings carry
-      // enabled:true since the fix; legacy all-mode bindings without the
-      // field are live too — only an explicit false is dormant)
-      if (bindings.some((b) => b.url && b.enabled !== false)) {
-        await showShareManager(host, sessionID)
-        host.ui.dialog.clear()
-        return
-      }
-      // not shared (or dormant): the normal flow — consent once, then share
-      const result = await runShareFlow(host, sid)
-      if (result.message === "consent required") {
-        const yes = await host.ui.showConfirm({
-          title: "Share Session",
-          message: "Publish this session (and its subagent sessions) to your openshare worker?\nThe link lets anyone with it read the conversation.",
-          confirmLabel: "Share",
-        })
-        if (!yes) return
-        try {
-          host.kv.set(CONSENT_KV_KEY, true)
-          dbgLog("consent kv.set ok")
-        } catch (e) {
-          dbgLog(`consent kv.set THREW: ${(e as Error)?.message ?? e}`)
-        }
-        try {
-          finish(host, await confirmShare(host, root))
-        } catch (e) {
-          dbgLog(`confirmShare rejected: ${(e as Error)?.stack ?? e}`)
-          finish(host, { ok: false, message: "Share failed (see debug log)." })
-        }
+      // enabled:true; legacy all-mode bindings without the field are live
+      // too — only an explicit false is dormant)
+      if (all.some((b) => b.url && b.enabled !== false)) {
+        // THE session menu — identical to /openshare → This session by
+        // construction (one surface, no duplicated manager). No
+        // dialog.clear() after: settings owns its chain end-to-end (the
+        // old fire-and-forget menu + immediate clear wiped it instantly —
+        // live-caught as "/share did nothing" on a shared session).
+        await settingsDialog(host, sid)
         return
       }
-      finish(host, result)
+      // everything was just cleared by the gone modal and the user chose
+      // Close — leaving it unshared is the answer, do not offer a share
+      if (goneShown && all.length === 0) return
+      // not shared (or dormant): explicit consent, every time
+      finish(host, await shareWithConsent(host, sid))
     },
   }
 }