@mirrowel/opencode-openshare 0.2.0-dev.2 → 0.2.1

package/dist/core.js

@@ -43,7 +43,7 @@
 //    secret must never reach viewers.
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { METADATA_KEY, loadConfig, resolveShareMode, spoolDirFor, URL_FILE_NONE, resolveServer, saveServerToken } from "./config.js";
 import { cursorFor, isV2NativeMessage, messageTombstone, normalizeV1Diff, normalizeV1Message } from "./contract.js";
 import { queueBindingWrite } from "./binding-queue.js";
@@ -139,6 +139,14 @@ function shareFlag(info) {
     }
     return { enabled: true, opts: Object.keys(opts).length ? opts : undefined };
 }
+/** The LIVE engine's resolved target urls (shared module state: the TUI
+ * entry reads this so surfaces that gate on "is anything configured" agree
+ * with what the engine actually targets - file config alone can miss
+ * plugin-options-layer config the TUI cannot see). */
+let liveTargets = [];
+export function engineTargetUrls() {
+    return liveTargets;
+}
 export function createEngine(deps) {
     let cfg = loadConfig(deps.pluginDir, deps.options);
     const mode = resolveShareMode(cfg, deps);
@@ -173,8 +181,16 @@ export function createEngine(deps) {
     log(`share mode: ${mode} (directory: ${deps.directory ?? "?"} worktree: ${deps.worktree ?? "?"})`);
     const resolveTargets = () => {
         const merged = {};
-        if (cfg.workerUrl)
+        const hasServers = !!cfg.servers && Object.keys(cfg.servers).length > 0;
+        // layer-aware legacy rule: a FILE workerUrl beside a FILE servers
+        // group would silently dual-home the session (live-caught surprise);
+        // an ENV workerUrl is the highest-priority layer and always joins.
+        const envWorker = !!process.env.OPENSHARE_WORKER_URL;
+        if (cfg.workerUrl && (!hasServers || envWorker))
             merged[cfg.workerUrl] = { token: cfg.createToken || "", active: true };
+        if (cfg.workerUrl && hasServers && !envWorker && !cfg.servers[cfg.workerUrl]) {
+            log(`legacy workerUrl ${cfg.workerUrl} ignored: a servers group is configured - remove one of the two`);
+        }
         if (cfg.servers)
             for (const [u, e] of Object.entries(cfg.servers))
                 merged[u] = { ...merged[u], ...e };
@@ -184,6 +200,7 @@ export function createEngine(deps) {
         return chosen.map((url) => ({ url, entry: merged[url] }));
     };
     let targets = resolveTargets();
+    liveTargets = targets.map((t) => t.url);
     // ---- per-server credentials (identity) ----------------------------------
     // Each server enrolls INDEPENDENTLY: a legacy root CREATE_TOKEN works
     // forever (server-side bootstrap); an osk_ user token is the normal
@@ -385,7 +402,8 @@ export function createEngine(deps) {
         badSignal: false,
         lastSentStatus: null,
         closed: false,
-        prefsSent: false,
+        lastError: null,
+        ttlClamped: null,
         binding: null,
         bindingQueried: false,
         optOuts: new Set(),
@@ -406,6 +424,7 @@ export function createEngine(deps) {
             spoolRoot = spoolDirFor(cfg);
             const before = new Set(targets.map((t) => t.url));
             targets = resolveTargets();
+            liveTargets = targets.map((t) => t.url);
             seedCredentials();
             clampToPolicy();
             if (debugEvents) {
@@ -626,6 +645,10 @@ export function createEngine(deps) {
         const value = { v: 2, servers, enabled: true };
         if (mode === "manual" && st.opts)
             value.opts = st.opts;
+        if (st.lastError)
+            value.lastError = st.lastError;
+        if (st.ttlClamped)
+            value.ttlClamped = st.ttlClamped;
         st.binding = value;
         st.wroteBinding = true;
         await writeMetadata(st, value);
@@ -887,7 +910,11 @@ export function createEngine(deps) {
             // Append: CI reads the file after each run; keeping every share
             // URL lets one file serve a whole workflow (the legacy original
             // overwrote with the latest only).
-            const file = cfg.urlFile || join(deps.directory ?? process.cwd(), "openshare.urls.txt");
+            const file = cfg.urlFile
+                ? isAbsolute(cfg.urlFile)
+                    ? cfg.urlFile
+                    : join(deps.directory ?? process.cwd(), cfg.urlFile)
+                : join(deps.directory ?? process.cwd(), "openshare.urls.txt");
             try {
                 appendFileSync(file, url + "\n");
                 if (cfg.announceStderr && (file !== lastUrlFile || !urlFileAnnounced)) {
@@ -896,18 +923,57 @@ export function createEngine(deps) {
                     log(`url file: ${file}`);
                 }
             }
-            catch { }
+            catch (e) {
+                // a CI pipeline reads this file after the process exits; a silent
+                // failure means the run's share URL is simply gone
+                logError(`url file write failed (${file}):`, e?.message || e);
+            }
         }
     };
+    let halfAuthWarned = false;
     const authFrame = (st) => {
         // always send both (empty strings included): attach with empty values
-        // REMOVES protection — an intentional owner action. Session opts
+        // REMOVES protection - an intentional owner action. Session opts
         // override the global config when set.
         const login = st.opts?.authLogin ?? cfg.authLogin ?? "";
         const password = st.opts?.authPassword ?? cfg.authPassword ?? "";
+        // both-or-none: the server builds a gate only from a full pair, so a
+        // half pair silently means "no gate" - refuse to send one and say so
+        if ((login === "") !== (password === "")) {
+            if (!halfAuthWarned) {
+                halfAuthWarned = true;
+                logError("read auth needs BOTH a login and a password - gate disabled until fixed");
+            }
+            return { authLogin: "", authPassword: "" };
+        }
         return { authLogin: login, authPassword: password };
     };
     const ttlFor = (st) => st.opts?.ttlDays ?? cfg.ttlDays;
+    /** Apply a metadata opts update. On a CHANGED opts set for a session with
+     * live sockets, re-send the attach frame over each open socket: the
+     * worker's attach path applies read-auth retroactively (rotating viewer
+     * tokens on change) and now also honors an explicit ttlDays override -
+     * so settings heal immediately instead of waiting for a reconnect.
+     * Re-attach is idempotent (no once-guard on init; earlySyncs empty at
+     * steady state) and revalidates the token. */
+    const applyOpts = (st, opts) => {
+        if (!opts)
+            return;
+        const prev = st.opts ? JSON.stringify(st.opts) : "";
+        st.opts = opts;
+        if (prev === JSON.stringify(opts))
+            return;
+        for (const [url, r] of st.remotes) {
+            if (!r.shareId || !r.secret || !r.wsReady)
+                continue;
+            const attach = { id: r.shareId, secret: r.secret, ...authFrame(st) };
+            if (st.opts?.ttlDays)
+                attach.ttlDays = st.opts.ttlDays;
+            const sent = wsSend(r, { op: "init", attach });
+            if (sent)
+                log(`opts re-synced to ${url.slice(0, 24)}${st.opts?.ttlDays ? ` (ttl ${st.opts.ttlDays}d)` : ""}`);
+        }
+    };
     /** Best-effort cleanup of a share we are about to abandon (refused
      * attach, mismatch recreate). Prevents husk litter; failures are fine —
      * the TTL sweeper collects strays eventually. */
@@ -1000,7 +1066,7 @@ export function createEngine(deps) {
                 st.remotes.delete(url);
             }
             // collisions resolved by the TUI: the binding entry for the server
-            // was removed — re-arm unless the same patch also opted out
+            // was removed - re-arm unless the same patch also opted out
             for (const r of [...st.remotes.values()]) {
                 if (!r.collided || st.optOuts.has(r.url))
                     continue;
@@ -1016,6 +1082,29 @@ export function createEngine(deps) {
                 r.announced = false;
                 queueConnect(st, r);
             }
+            // re-share after "leave as-is": the entry kept its id/secret and the
+            // opt-out marker is gone - re-arm a remote that ATTACHES the same
+            // page (same URL), then backfill so the frozen gap catches up
+            // (dedupe hashes describe the OLD remote set, not this revival)
+            let rearmed = false;
+            for (const [url, e] of Object.entries(servers)) {
+                if (st.optOuts.has(url) || st.remotes.has(url))
+                    continue;
+                const ee = e;
+                if (typeof ee.id !== "string" || typeof ee.secret !== "string" || !ee.id)
+                    continue;
+                const r = remoteFor(st, url);
+                r.shareId = ee.id;
+                r.secret = ee.secret;
+                r.ackedRev = typeof ee.rev === "number" ? ee.rev : 0;
+                log(`re-share: re-arming ${url.slice(0, 24)} on share ${ee.id}`);
+                queueConnect(st, r);
+                rearmed = true;
+            }
+            if (rearmed) {
+                st.sentHash.clear();
+                chain = chain.then(() => backfill(st)).catch((e) => logError("re-share backfill error", e?.message || e));
+            }
         }
         catch { }
     };
@@ -1277,8 +1366,10 @@ export function createEngine(deps) {
                 const err = String(frame.error ?? "");
                 if (/frozen/i.test(err)) {
                     // owner frozen: every control path is severed server-side.
-                    // Re-enrolling would orphan the shares — surface and stop.
+                    // Re-enrolling would orphan the shares - surface and stop.
                     r.authBlocked = true;
+                    st.lastError = `share frozen by the hoster (owner frozen) - contact the server admin`;
+                    scheduleBindingWrite(st);
                     logError(`${r.url}: share frozen by the hoster (owner frozen) - edits refused; contact the server admin`);
                     try {
                         r.ws?.close(4000, "frozen");
@@ -1333,8 +1424,10 @@ export function createEngine(deps) {
                 if (/limit|too many|rate/i.test(err)) {
                     // quota/429 ("max shares reached", "daily create limit", the
                     // anonymous caps): an immediate re-init on the same socket is a
-                    // hot loop against the server — back off through the normal
+                    // hot loop against the server - back off through the normal
                     // reconnect cadence instead
+                    st.lastError = `create refused: ${frame.error ?? "rate limited"}`;
+                    scheduleBindingWrite(st);
                     logError(`${r.url}: create refused:`, frame.error, "- retrying with backoff");
                     r.connecting = false;
                     try {
@@ -1346,6 +1439,8 @@ export function createEngine(deps) {
                     return;
                 }
                 logError(`${r.url}: init refused:`, frame.error, "- creating fresh share");
+                st.lastError = `init refused: ${frame.error ?? "unknown"}`;
+                scheduleBindingWrite(st);
                 deleteAbandoned(r);
                 r.shareId = null;
                 r.secret = null;
@@ -1401,6 +1496,21 @@ export function createEngine(deps) {
                 applyPolicy(frame.policy, r.url);
             r.intentionalClose = false;
             touch(st);
+            // the ack carries the RESOLVED ttl: surface a server/token clamp to
+            // the binding once, and a successful handshake clears any stale
+            // refusal reason the TUI may be showing
+            if (typeof frame.ttlDays === "number") {
+                const wanted = ttlFor(st);
+                const clamp = wanted != null && frame.ttlDays !== wanted ? { requested: wanted, effective: frame.ttlDays } : null;
+                if (JSON.stringify(clamp) !== JSON.stringify(st.ttlClamped)) {
+                    st.ttlClamped = clamp;
+                    scheduleBindingWrite(st);
+                }
+            }
+            if (st.lastError) {
+                st.lastError = null;
+                scheduleBindingWrite(st);
+            }
             announceUrl(st, r);
             // first binding write is immediate (the TUI waits on the URL in
             // session metadata); ack-driven rev updates stay debounced
@@ -2343,10 +2453,6 @@ export function createEngine(deps) {
                 // activates anything on its own
                 const st = sessions.get(parent);
                 if (st?.activated && !st.closed) {
-                    if (!st.prefsSent) {
-                        st.prefsSent = true;
-                        enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-                    }
                     if (info)
                         enqueue(st, itemFor("session", redact(info), sid));
                 }
@@ -2358,11 +2464,7 @@ export function createEngine(deps) {
                 if (st?.activated && !st.closed) {
                     // already sharing: opts updates apply, flag removal handled below
                     if (flag.opts)
-                        st.opts = flag.opts;
-                    if (!st.prefsSent) {
-                        st.prefsSent = true;
-                        enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-                    }
+                        applyOpts(st, flag.opts);
                     if (info)
                         enqueue(st, itemFor("session", redact(info), sid));
                     if (t === "session.updated")
@@ -2370,11 +2472,6 @@ export function createEngine(deps) {
                     return;
                 }
                 activate(sid, flag.opts, info);
-                const fresh = sessions.get(sid);
-                if (fresh && !fresh.prefsSent) {
-                    fresh.prefsSent = true;
-                    enqueue(fresh, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-                }
                 return;
             }
             if (st?.activated && !st.closed && t === "session.updated") {
@@ -2431,10 +2528,6 @@ export function createEngine(deps) {
         }
         if (!st)
             return;
-        if (!st.prefsSent) {
-            st.prefsSent = true;
-            enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-        }
         if (info)
             enqueue(st, itemFor("session", redact(info), sid));
         if (t === "session.updated" && st.activated && !st.closed) {
@@ -2701,7 +2794,7 @@ export function createEngine(deps) {
                     if (flushed && typeof flushed.then === "function")
                         await flushed.catch(() => { });
                     // dispose with a mid-handshake socket: the deferred pending
-                    // would die with the process — land it over HTTP instead
+                    // would die with the process - land it over HTTP instead
                     for (const r of st.remotes.values()) {
                         if (!r.wsReady && r.shareId && r.pending.length) {
                             await flushViaHttp(st, r).catch(() => { });
@@ -2722,6 +2815,26 @@ export function createEngine(deps) {
                     st.metaTimer = null;
                     await writeBinding(st).catch(() => { });
                 }
+                // URL-at-exit barrier: a very short `opencode run` can exit before
+                // the create handshake finishes, and CI reads the urlFile the
+                // moment the process ends. Bounded 5s wait for every share that is
+                // mid-handshake or not yet announced (a dead worker costs exactly
+                // the cap; a healthy one is instant).
+                const barrierStart = Date.now();
+                while (Date.now() - barrierStart < 5000) {
+                    let pendingAnnounce = false;
+                    for (const st of sessions.values()) {
+                        for (const r of st.remotes.values()) {
+                            if (r.authBlocked || r.collided)
+                                continue;
+                            if ((r.shareId && !r.announced) || (!r.shareId && (r.ws || r.connecting)))
+                                pendingAnnounce = true;
+                        }
+                    }
+                    if (!pendingAnnounce)
+                        break;
+                    await new Promise((res) => setTimeout(res, 100));
+                }
                 for (const st of sessions.values()) {
                     for (const r of st.remotes.values()) {
                         try {

package/dist/settings.d.ts

@@ -17,7 +17,7 @@ export declare function adminConsole(host: ShareHostApi, pinnedUrl?: string): Pr
  * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
  * Save semantics unchanged: root Exit saves when dirty; submenu Back
  * just returns. */
-export declare function settingsDialog(host: ShareHostApi, startAtSession?: string): Promise<void>;
+export declare function settingsDialog(host: ShareHostApi, startAtSession?: string, startGroup?: "session"): Promise<void>;
 /** Onboarding shown by /share when no server is connected: connect flow
  * first (URL + optional code = enrolled + active), full settings as the
  * fallback for manual configuration. */

package/dist/settings.js

@@ -5,7 +5,7 @@
 //
 // Sections: Connection, Sharing, Read auth, Advanced, This session.
 import { configSourceMap, moduleDir, writeCandidates } from "./config.js";
-import { adminClient, adminTokenFor, currentConfig, deleteServerEntry, disconnectAtServer, enrollAtServer, hostOf, isConfigured, normServerUrl, probeAuthMode, probeWorker, patchSessionBinding, readBinding, readBindings, resolveRoot, rotateAtServer, runUnshareFlow, saveConfig, saveServerEntry, serverEntries, setShareFlag, shareWithConsent, workerDeleteShare, } from "./share-flow.js";
+import { adminClient, adminTokenFor, currentConfig, deleteServerEntry, disconnectAtServer, enrollAtServer, hostOf, isConfigured, normServerUrl, probeAuthMode, probeWorker, patchSessionBinding, readBinding, readBindings, resolveRoot, rotateAtServer, runUnshareFlow, saveConfig, saveServerEntry, meClient, serverEntries, setShareOpts, shareWithConsent, workerDeleteShare, } from "./share-flow.js";
 import { DIALOG_WIDTH_COLUMNS, kvHeightPercentOf, kvWidthOf, nextDialogWidth, UI_HEIGHT_PERCENT_KV, UI_WIDTH_KV, clampHeightPercent } from "./ui-prefs.js";
 /** description suffix: `[from <source>]` when a key is overridden by a
  * file/env higher in the chain than the write target. */
@@ -58,11 +58,11 @@ const LABELS = {
     },
     shareMode: {
         label: "Share mode",
-        help: '"all" shares every session; "manual" needs /share. Default: TUI presence.',
+        help: '"all" shares every session; "manual" needs /share. Default: TUI presence. Takes effect after opencode restarts.',
         kind: "text",
         options: ["auto", "all", "manual"],
         section: "Sharing",
-        info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared — share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides — installing the TUI part means manual, server-only means all.',
+        info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared - share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides - installing the TUI part means manual, server-only means all.\n\nNOTE: the mode is resolved once at plugin load. Changing it here saves immediately but only takes effect after opencode restarts - until then new sessions keep following the OLD mode.',
         def: "auto (TUI presence)",
     },
     debounceMs: {
@@ -97,15 +97,6 @@ const LABELS = {
         info: "How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.\n\nA per-session override lives in the This-session section; it is sent at create/attach time.",
         def: "worker cap (90 on the reference deployment)",
     },
-    openTasksInNewTab: {
-        label: "Open tasks in new tab",
-        help: "Viewer: task rows open subagent pages in a new tab.",
-        kind: "text",
-        options: ["true", "false"],
-        section: "Sharing",
-        info: "Viewer behavior only: clicking a task (subagent) row opens its sub-page in a new browser tab instead of navigating. true/false.",
-        def: "true",
-    },
     authLogin: {
         label: "Read auth: login",
         help: "Optional read gate for share pages. Empty removes protection on the next attach.",
@@ -165,10 +156,8 @@ function helpForKey(key, cfg, sources) {
 function displayValue(key, cfg) {
     if (key === "createToken" || key === "authPassword")
         return mask(String(cfg[key] ?? ""));
-    if (key === "openTasksInNewTab")
-        return String(cfg.openTasksInNewTab !== false);
     if (key === "announceStderr")
-        return String(cfg.announceStderr !== false);
+        return cfg.announceStderr !== false ? "on" : "off";
     const value = cfg[key];
     return value === undefined || value === "" ? "(not set)" : String(value);
 }
@@ -194,7 +183,7 @@ async function editKey(host, cfg, key) {
         const next = { ...cfg };
         if (key === "shareMode")
             next[key] = picked === "auto" ? undefined : picked;
-        else if (key === "openTasksInNewTab" || key === "announceStderr")
+        else if (key === "announceStderr")
             next[key] = picked === "true";
         else
             next[key] = picked;
@@ -294,6 +283,8 @@ async function serverMenu(host, url) {
             options.push({ title: "Enroll now", value: "enroll", description: holdsRoot ? "join as a user via code/public enrollment" : "get a user token immediately" });
         if (mine.entry.token && !holdsRoot)
             options.push({ title: "Rotate token", value: "rotate", description: "new token, old one revoked" });
+        if (mine.entry.token && !holdsRoot)
+            options.push({ title: "Your account", value: "account", description: "limits, token expiry, your shares" });
         if (mine.entry.token && !holdsRoot)
             options.push({ title: "Disconnect", value: "disconnect", description: "revoke the token server-side and forget it", danger: true });
         options.push({
@@ -309,12 +300,16 @@ async function serverMenu(host, url) {
         if (choice === undefined || choice === "__back")
             return;
         if (choice === "active") {
-            for (const other of entries) {
-                if (other.url !== url)
-                    saveServerEntry(other.url, { active: undefined });
-            }
+            // make-primary WITHOUT collapsing fan-out: other explicit actives
+            // stay active (the engine targets every active entry); silently
+            // deactivating them destroyed hand-built multi-server setups
             saveServerEntry(url, { active: true });
-            host.ui.toast({ variant: "success", title: "OpenShare", message: `${url} is now the active server.` });
+            const stillActive = serverEntries().filter((s) => s.active);
+            host.ui.toast({
+                variant: "success",
+                title: "OpenShare",
+                message: stillActive.length > 1 ? `${url} is primary - ${stillActive.length} servers stay ACTIVE (fan-out): new sessions mirror to all of them.` : `${url} is now the active server.`,
+            });
             return;
         }
         if (choice === "adopt") {
@@ -367,6 +362,32 @@ async function serverMenu(host, url) {
             }
             continue;
         }
+        if (choice === "account") {
+            const me = meClient(url, mine.entry.token ?? "");
+            const [meRes, sharesRes] = await Promise.all([me.me(), me.myShares()]);
+            if (!meRes.ok) {
+                await showInfo(host.ui, { title: "Account", message: `Could not read your account: ${meRes.error ?? "error"}.\nIf the token was revoked server-side, use Enroll now instead.` });
+                continue;
+            }
+            const d = meRes.data;
+            const lim = d.token?.limits ?? {};
+            const fmt = (v) => (v ? String(v) : "unlimited");
+            const lines = [
+                `User: ${d.label} (${d.userId})`,
+                `Token: ${d.token?.label ?? "?"} - expires ${d.token?.expiresAt ? new Date(d.token.expiresAt).toISOString().slice(0, 10) : "never"}`,
+                `Limits: live shares ${fmt(lim.maxLiveShares)} - max TTL ${fmt(lim.maxTtlDays)}d - daily creates ${fmt(lim.dailyCreates)}`,
+            ];
+            if (sharesRes.ok) {
+                const shares = sharesRes.data?.shares ?? [];
+                lines.push(`Shares: ${shares.length} (${shares.filter((s) => s.status === "live").length} live)`);
+                for (const s of shares.slice(0, 10))
+                    lines.push(`  ${s.id} - ${s.status} - ${new Date(s.createdAt).toISOString().slice(0, 10)}`);
+                if (shares.length > 10)
+                    lines.push(`  ...and ${shares.length - 10} more`);
+            }
+            await showInfo(host.ui, { title: "Your account", message: lines.join("\n") });
+            continue;
+        }
         if (choice === "rotate") {
             const res = await rotateAtServer(url, mine.entry.token ?? "");
             if (res.ok && res.token) {
@@ -379,7 +400,12 @@ async function serverMenu(host, url) {
             continue;
         }
         if (choice === "disconnect") {
-            const sure = await showConfirm(host.ui, { title: "Disconnect", message: `Revoke the token at ${url} and forget it?\nYour shares stay (read-only for you until TTL).`, confirmLabel: "Disconnect", danger: true });
+            const sure = await showConfirm(host.ui, {
+                title: "Disconnect",
+                message: `Revoke the token at ${url} and forget it?\nRevoking your last token freezes control of ALL your shares there (even with the share secrets) - pages stay readable until their TTL; only the server admin can restore control.`,
+                confirmLabel: "Disconnect",
+                danger: true,
+            });
             if (!sure)
                 continue;
             const res = await disconnectAtServer(url, mine.entry.token ?? "");
@@ -813,7 +839,7 @@ async function adminSharesMenu(host, client, url, shares, users) {
  * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
  * Save semantics unchanged: root Exit saves when dirty; submenu Back
  * just returns. */
-export async function settingsDialog(host, startAtSession) {
+export async function settingsDialog(host, startAtSession, startGroup) {
     let cfg = currentConfig();
     let dirty = false;
     // Write target (owner rule): global settings home by default; any other
@@ -967,17 +993,25 @@ export async function settingsDialog(host, startAtSession) {
             }
         }
         const binding = bindings[0];
+        if (binding?.lastError || binding?.ttlClamped) {
+            const bits = [];
+            if (binding?.ttlClamped)
+                bits.push(`TTL clamped ${binding.ttlClamped.requested}d -> ${binding.ttlClamped.effective}d by server/token policy`);
+            if (binding?.lastError)
+                bits.push(`last share error: ${binding.lastError}`);
+            rows.push({ title: "Share status notes", value: "__notes", description: bits[0].slice(0, 60), disabled: true, help: `Engine-recorded notes for this session's share(s):\n\n${bits.join("\n")}\n\nThe clamp note appears when the server or your token's policy reduced a requested TTL. The error note is the engine's last create/attach refusal (quota, freeze, rate limit) - it clears on the next successful sync.` });
+        }
         rows.push({
             title: "Session TTL override (days)",
             value: "session:ttl",
             description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-            help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. Applied at the next create/attach.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
+            help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
         });
         rows.push({
             title: "Session read auth",
             value: "session:auth",
             description: binding?.opts?.authLogin ? `${binding.opts.authLogin} / ****` : "(config default)",
-            help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth. Applied at the next create/attach; removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
+            help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth; a login and password are both required (or neither). On a live share it applies immediately; otherwise when you share. Removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
         });
         return rows;
     };
@@ -1161,11 +1195,11 @@ export async function settingsDialog(host, startAtSession) {
                 });
                 if (!pick || pick === "__cancel")
                     return;
-                for (const s of serverEntries())
-                    if (s.url !== pick)
-                        saveServerEntry(s.url, { active: undefined });
+                // fan-out add: activate the picked server WITHOUT deactivating the
+                // current ones - this session (and new sessions) mirror everywhere
                 saveServerEntry(pick, { active: true });
-                host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated — this session mirrors there within seconds.` });
+                const nActive = serverEntries().filter((s) => s.active).length;
+                host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated (${nActive} active) - this session mirrors there within seconds.` });
                 return;
             }
             if (choice === "session:unshare") {
@@ -1180,18 +1214,29 @@ export async function settingsDialog(host, startAtSession) {
                 if (how === undefined || how === "__cancel")
                     return;
                 if (how === "leave") {
-                    const all = await readBindings(host.client, root);
+                    const allB = await readBindings(host.client, root);
                     const okPatch = await patchSessionBinding(host.client, root, (servers) => {
-                        for (const b of all) {
+                        for (const b of allB) {
                             if (!b.server)
                                 continue;
-                            delete servers[b.server];
-                            servers[b.server] = { optedOut: true };
+                            // keep id/secret on the opt-out marker: the snapshot stays
+                            // deletable later and re-sharing reuses the binding instead
+                            // of stalling on a secret-less marker (live-caught as "can
+                            // never unshare or re-share after leave-as-is")
+                            servers[b.server] = { ...servers[b.server], id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true };
                         }
                     });
-                    host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs." : "Could not update the binding." });
+                    host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs (delete stays available here)." : "Could not update the binding." });
                     return;
                 }
+                const sureAll = await showConfirm(host.ui, {
+                    title: "Delete every page?",
+                    message: `Permanently delete ${live.length} share page(s) and stop sharing?\nEvery link stops working for everyone. This cannot be undone.`,
+                    confirmLabel: "Delete every page",
+                    danger: true,
+                });
+                if (!sureAll)
+                    return;
                 const result = await runUnshareFlow(host, startAtSession);
                 host.ui.toast({ variant: result.ok ? "success" : "error", title: "OpenShare", message: result.message });
                 return;
@@ -1211,17 +1256,30 @@ export async function settingsDialog(host, startAtSession) {
                     }
                     opts.ttlDays = Math.floor(days);
                 }
-                await setShareFlag(host.client, root, opts);
-                host.ui.toast({ variant: "success", title: "OpenShare", message: opts.ttlDays !== undefined ? `Session TTL: ${opts.ttlDays}d (applies at the next attach/create)` : "Session TTL override cleared" });
+                await setShareOpts(host.client, root, opts);
+                const liveNow = live.length > 0;
+                host.ui.toast({
+                    variant: "success",
+                    title: "OpenShare",
+                    message: liveNow
+                        ? `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
+                        : `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d` : "(default)"} - saved, applies when you share.`,
+                });
                 return;
             }
             if (choice === "session:auth") {
-                const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = use config default", value: current?.opts?.authLogin ?? "" });
+                const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = no read auth", value: current?.opts?.authLogin ?? "" });
                 if (login === undefined)
                     return;
-                const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: "empty = no password" });
+                const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: login === "" ? "(unused)" : "password (required with a login)" });
                 if (password === undefined)
                     return;
+                // both-or-none: the server builds a gate only from a full pair, and
+                // rendering half a pair would show protection that does not exist
+                if ((login === "") !== (password === "")) {
+                    host.ui.toast({ variant: "error", title: "OpenShare", message: "Read auth needs both a login and a password - or neither (no gate)." });
+                    return;
+                }
                 const opts = { ...(current?.opts ?? {}) };
                 if (login === "") {
                     delete opts.authLogin;
@@ -1229,13 +1287,11 @@ export async function settingsDialog(host, startAtSession) {
                 }
                 else {
                     opts.authLogin = login;
-                    if (password !== "")
-                        opts.authPassword = password;
-                    else
-                        delete opts.authPassword;
+                    opts.authPassword = password;
                 }
-                await setShareFlag(host.client, root, opts);
-                host.ui.toast({ variant: "success", title: "OpenShare", message: "Session read auth saved (applies at the next attach/create)." });
+                await setShareOpts(host.client, root, opts);
+                const liveNow2 = live.length > 0;
+                host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` });
                 return;
             }
         }
@@ -1254,6 +1310,10 @@ export async function settingsDialog(host, startAtSession) {
         }
     };
     // ---- root: compact group list with live summaries --------------------------
+    // /share on a shared session lands HERE, straight in the session menu -
+    // one selection sooner (Back still reaches the full root)
+    if (startAtSession && startGroup === "session")
+        await groupMenu("session");
     const seconds = (ms, fallback) => `${Math.round((ms ?? fallback) / 100) / 10}s`;
     while (true) {
         const servers = serverEntries(cfg);