@mirrowel/opencode-openshare 0.2.0-dev.2 → 0.2.1

package/src/core.ts

@@ -44,7 +44,7 @@
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
 import { createHash } from "node:crypto"
-import { join } from "node:path"
+import { isAbsolute, join } from "node:path"
 import { METADATA_KEY, loadConfig, resolveShareMode, spoolDirFor, URL_FILE_NONE, resolveServer, saveServerToken, type ShareConfig, type ShareMode, type ServerEntry } from "./config.js"
 import { CONTRACT_VERSION, cursorFor, isV2NativeMessage, messageTombstone, normalizeV1Diff, normalizeV1Message } from "./contract.js"
 import { queueBindingWrite } from "./binding-queue.js"
@@ -146,7 +146,12 @@ type SessionState = {
   badSignal: boolean
   lastSentStatus: string | null
   closed: boolean
-  prefsSent: boolean
+  /** last create/attach refusal reason surfaced to the TUI (cleared on a
+   * successful init-ok); rides the session binding so /share failures can
+   * say WHY instead of a generic timeout */
+  lastError: string | null
+  /** server/token policy clamped our requested TTL: {requested, effective} */
+  ttlClamped: { requested: number; effective: number } | null
   binding: Record<string, unknown> | null // mirrors what was written into session metadata (v2 map)
   bindingQueried: boolean
   /** per-session server opt-outs (TUI "stop sharing here" / "leave as-is"):
@@ -296,6 +301,15 @@ function shareFlag(info: SessionInfo | undefined): { enabled: boolean; opts: Ses
   return { enabled: true, opts: Object.keys(opts).length ? opts : undefined }
 }
 
+/** The LIVE engine's resolved target urls (shared module state: the TUI
+ * entry reads this so surfaces that gate on "is anything configured" agree
+ * with what the engine actually targets - file config alone can miss
+ * plugin-options-layer config the TUI cannot see). */
+let liveTargets: string[] = []
+export function engineTargetUrls(): string[] {
+  return liveTargets
+}
+
 export function createEngine(deps: EngineDeps): Engine {
   let cfg = loadConfig(deps.pluginDir, deps.options)
   const mode: ShareMode = resolveShareMode(cfg, deps)
@@ -342,7 +356,15 @@ export function createEngine(deps: EngineDeps): Engine {
   type ServerTarget = { url: string; entry: ServerEntry }
   const resolveTargets = (): ServerTarget[] => {
     const merged: Record<string, ServerEntry> = {}
-    if (cfg.workerUrl) merged[cfg.workerUrl] = { token: cfg.createToken || "", active: true }
+    const hasServers = !!cfg.servers && Object.keys(cfg.servers).length > 0
+    // layer-aware legacy rule: a FILE workerUrl beside a FILE servers
+    // group would silently dual-home the session (live-caught surprise);
+    // an ENV workerUrl is the highest-priority layer and always joins.
+    const envWorker = !!process.env.OPENSHARE_WORKER_URL
+    if (cfg.workerUrl && (!hasServers || envWorker)) merged[cfg.workerUrl] = { token: cfg.createToken || "", active: true }
+    if (cfg.workerUrl && hasServers && !envWorker && !cfg.servers![cfg.workerUrl]) {
+      log(`legacy workerUrl ${cfg.workerUrl} ignored: a servers group is configured - remove one of the two`)
+    }
     if (cfg.servers) for (const [u, e] of Object.entries(cfg.servers)) merged[u] = { ...merged[u], ...e }
     const urls = Object.keys(merged)
     const actives = urls.filter((u) => merged[u].active)
@@ -350,6 +372,7 @@ export function createEngine(deps: EngineDeps): Engine {
     return chosen.map((url) => ({ url, entry: merged[url] }))
   }
   let targets = resolveTargets()
+  liveTargets = targets.map((t) => t.url)
 
   // ---- per-server credentials (identity) ----------------------------------
   // Each server enrolls INDEPENDENTLY: a legacy root CREATE_TOKEN works
@@ -550,7 +573,8 @@ export function createEngine(deps: EngineDeps): Engine {
     badSignal: false,
     lastSentStatus: null,
     closed: false,
-    prefsSent: false,
+    lastError: null,
+    ttlClamped: null,
     binding: null,
     bindingQueried: false,
     optOuts: new Set(),
@@ -572,6 +596,7 @@ export function createEngine(deps: EngineDeps): Engine {
       spoolRoot = spoolDirFor(cfg)
       const before = new Set(targets.map((t) => t.url))
       targets = resolveTargets()
+      liveTargets = targets.map((t) => t.url)
       seedCredentials()
       clampToPolicy()
       if (debugEvents) {
@@ -781,6 +806,8 @@ export function createEngine(deps: EngineDeps): Engine {
     // live is now uniformly "url && enabled !== false").
     const value: Record<string, unknown> = { v: 2, servers, enabled: true }
     if (mode === "manual" && st.opts) value.opts = st.opts
+    if (st.lastError) value.lastError = st.lastError
+    if (st.ttlClamped) value.ttlClamped = st.ttlClamped
     st.binding = value
     st.wroteBinding = true
     await writeMetadata(st, value)
@@ -1025,7 +1052,11 @@ export function createEngine(deps: EngineDeps): Engine {
       // Append: CI reads the file after each run; keeping every share
       // URL lets one file serve a whole workflow (the legacy original
       // overwrote with the latest only).
-      const file = cfg.urlFile || join(deps.directory ?? process.cwd(), "openshare.urls.txt")
+      const file = cfg.urlFile
+        ? isAbsolute(cfg.urlFile)
+          ? cfg.urlFile
+          : join(deps.directory ?? process.cwd(), cfg.urlFile)
+        : join(deps.directory ?? process.cwd(), "openshare.urls.txt")
       try {
         appendFileSync(file, url + "\n")
         if (cfg.announceStderr && (file !== lastUrlFile || !urlFileAnnounced)) {
@@ -1033,21 +1064,56 @@ export function createEngine(deps: EngineDeps): Engine {
           lastUrlFile = file
           log(`url file: ${file}`)
         }
-      } catch {}
+      } catch (e) {
+        // a CI pipeline reads this file after the process exits; a silent
+        // failure means the run's share URL is simply gone
+        logError(`url file write failed (${file}):`, (e as Error)?.message || e)
+      }
     }
   }
 
+  let halfAuthWarned = false
   const authFrame = (st: SessionState) => {
     // always send both (empty strings included): attach with empty values
-    // REMOVES protection — an intentional owner action. Session opts
+    // REMOVES protection - an intentional owner action. Session opts
     // override the global config when set.
     const login = st.opts?.authLogin ?? cfg.authLogin ?? ""
     const password = st.opts?.authPassword ?? cfg.authPassword ?? ""
+    // both-or-none: the server builds a gate only from a full pair, so a
+    // half pair silently means "no gate" - refuse to send one and say so
+    if ((login === "") !== (password === "")) {
+      if (!halfAuthWarned) {
+        halfAuthWarned = true
+        logError("read auth needs BOTH a login and a password - gate disabled until fixed")
+      }
+      return { authLogin: "", authPassword: "" }
+    }
     return { authLogin: login, authPassword: password }
   }
 
   const ttlFor = (st: SessionState) => st.opts?.ttlDays ?? cfg.ttlDays
 
+  /** Apply a metadata opts update. On a CHANGED opts set for a session with
+   * live sockets, re-send the attach frame over each open socket: the
+   * worker's attach path applies read-auth retroactively (rotating viewer
+   * tokens on change) and now also honors an explicit ttlDays override -
+   * so settings heal immediately instead of waiting for a reconnect.
+   * Re-attach is idempotent (no once-guard on init; earlySyncs empty at
+   * steady state) and revalidates the token. */
+  const applyOpts = (st: SessionState, opts: SessionOpts | undefined) => {
+    if (!opts) return
+    const prev = st.opts ? JSON.stringify(st.opts) : ""
+    st.opts = opts
+    if (prev === JSON.stringify(opts)) return
+    for (const [url, r] of st.remotes) {
+      if (!r.shareId || !r.secret || !r.wsReady) continue
+      const attach: Record<string, unknown> = { id: r.shareId, secret: r.secret, ...authFrame(st) }
+      if (st.opts?.ttlDays) attach.ttlDays = st.opts.ttlDays
+      const sent = wsSend(r, { op: "init", attach })
+      if (sent) log(`opts re-synced to ${url.slice(0, 24)}${st.opts?.ttlDays ? ` (ttl ${st.opts.ttlDays}d)` : ""}`)
+    }
+  }
+
   /** Best-effort cleanup of a share we are about to abandon (refused
    * attach, mismatch recreate). Prevents husk litter; failures are fine —
    * the TTL sweeper collects strays eventually. */
@@ -1130,7 +1196,7 @@ export function createEngine(deps: EngineDeps): Engine {
         st.remotes.delete(url)
       }
       // collisions resolved by the TUI: the binding entry for the server
-      // was removed — re-arm unless the same patch also opted out
+      // was removed - re-arm unless the same patch also opted out
       for (const r of [...st.remotes.values()]) {
         if (!r.collided || st.optOuts.has(r.url)) continue
         if (entryUrls.has(r.url)) continue
@@ -1143,6 +1209,27 @@ export function createEngine(deps: EngineDeps): Engine {
         r.announced = false
         queueConnect(st, r)
       }
+      // re-share after "leave as-is": the entry kept its id/secret and the
+      // opt-out marker is gone - re-arm a remote that ATTACHES the same
+      // page (same URL), then backfill so the frozen gap catches up
+      // (dedupe hashes describe the OLD remote set, not this revival)
+      let rearmed = false
+      for (const [url, e] of Object.entries(servers as Record<string, unknown>)) {
+        if (st.optOuts.has(url) || st.remotes.has(url)) continue
+        const ee = e as Record<string, unknown>
+        if (typeof ee.id !== "string" || typeof ee.secret !== "string" || !ee.id) continue
+        const r = remoteFor(st, url)
+        r.shareId = ee.id
+        r.secret = ee.secret
+        r.ackedRev = typeof ee.rev === "number" ? ee.rev : 0
+        log(`re-share: re-arming ${url.slice(0, 24)} on share ${ee.id}`)
+        queueConnect(st, r)
+        rearmed = true
+      }
+      if (rearmed) {
+        st.sentHash.clear()
+        chain = chain.then(() => backfill(st)).catch((e) => logError("re-share backfill error", (e as Error)?.message || e))
+      }
     } catch {}
   }
 
@@ -1387,8 +1474,10 @@ export function createEngine(deps: EngineDeps): Engine {
         const err = String(frame.error ?? "")
         if (/frozen/i.test(err)) {
           // owner frozen: every control path is severed server-side.
-          // Re-enrolling would orphan the shares — surface and stop.
+          // Re-enrolling would orphan the shares - surface and stop.
           r.authBlocked = true
+          st.lastError = `share frozen by the hoster (owner frozen) - contact the server admin`
+          scheduleBindingWrite(st)
           logError(`${r.url}: share frozen by the hoster (owner frozen) - edits refused; contact the server admin`)
           try {
             r.ws?.close(4000, "frozen")
@@ -1438,8 +1527,10 @@ export function createEngine(deps: EngineDeps): Engine {
         if (/limit|too many|rate/i.test(err)) {
           // quota/429 ("max shares reached", "daily create limit", the
           // anonymous caps): an immediate re-init on the same socket is a
-          // hot loop against the server — back off through the normal
+          // hot loop against the server - back off through the normal
           // reconnect cadence instead
+          st.lastError = `create refused: ${frame.error ?? "rate limited"}`
+          scheduleBindingWrite(st)
           logError(`${r.url}: create refused:`, frame.error, "- retrying with backoff")
           r.connecting = false
           try {
@@ -1449,6 +1540,8 @@ export function createEngine(deps: EngineDeps): Engine {
           return
         }
         logError(`${r.url}: init refused:`, frame.error, "- creating fresh share")
+        st.lastError = `init refused: ${frame.error ?? "unknown"}`
+        scheduleBindingWrite(st)
         deleteAbandoned(r)
         r.shareId = null
         r.secret = null
@@ -1499,6 +1592,21 @@ export function createEngine(deps: EngineDeps): Engine {
       if (frame.policy) applyPolicy(frame.policy, r.url)
       r.intentionalClose = false
       touch(st)
+      // the ack carries the RESOLVED ttl: surface a server/token clamp to
+      // the binding once, and a successful handshake clears any stale
+      // refusal reason the TUI may be showing
+      if (typeof frame.ttlDays === "number") {
+        const wanted = ttlFor(st)
+        const clamp = wanted != null && frame.ttlDays !== wanted ? { requested: wanted, effective: frame.ttlDays } : null
+        if (JSON.stringify(clamp) !== JSON.stringify(st.ttlClamped)) {
+          st.ttlClamped = clamp
+          scheduleBindingWrite(st)
+        }
+      }
+      if (st.lastError) {
+        st.lastError = null
+        scheduleBindingWrite(st)
+      }
       announceUrl(st, r)
       // first binding write is immediate (the TUI waits on the URL in
       // session metadata); ack-driven rev updates stay debounced
@@ -2400,10 +2508,6 @@ export function createEngine(deps: EngineDeps): Engine {
         // activates anything on its own
         const st = sessions.get(parent)
         if (st?.activated && !st.closed) {
-          if (!st.prefsSent) {
-            st.prefsSent = true
-            enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid))
-          }
           if (info) enqueue(st, itemFor("session", redact(info), sid))
         }
         return
@@ -2413,21 +2517,12 @@ export function createEngine(deps: EngineDeps): Engine {
       if (flag.enabled) {
         if (st?.activated && !st.closed) {
           // already sharing: opts updates apply, flag removal handled below
-          if (flag.opts) st.opts = flag.opts
-          if (!st.prefsSent) {
-            st.prefsSent = true
-            enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid))
-          }
+          if (flag.opts) applyOpts(st, flag.opts)
           if (info) enqueue(st, itemFor("session", redact(info), sid))
           if (t === "session.updated") chain = chain.then(() => refreshOptOuts(st)).catch(() => {})
           return
         }
         activate(sid, flag.opts, info)
-        const fresh = sessions.get(sid)
-        if (fresh && !fresh.prefsSent) {
-          fresh.prefsSent = true
-          enqueue(fresh, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid))
-        }
         return
       }
       if (st?.activated && !st.closed && t === "session.updated") {
@@ -2483,10 +2578,6 @@ export function createEngine(deps: EngineDeps): Engine {
       }
     }
     if (!st) return
-    if (!st.prefsSent) {
-      st.prefsSent = true
-      enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid))
-    }
     if (info) enqueue(st, itemFor("session", redact(info), sid))
     if (t === "session.updated" && st.activated && !st.closed) {
       chain = chain.then(() => refreshOptOuts(st)).catch(() => {})
@@ -2728,7 +2819,7 @@ export function createEngine(deps: EngineDeps): Engine {
           const flushed = flush(st)
           if (flushed && typeof (flushed as Promise<unknown>).then === "function") await flushed.catch(() => {})
           // dispose with a mid-handshake socket: the deferred pending
-          // would die with the process — land it over HTTP instead
+          // would die with the process - land it over HTTP instead
           for (const r of st.remotes.values()) {
             if (!r.wsReady && r.shareId && r.pending.length) {
               await flushViaHttp(st, r).catch(() => {})
@@ -2748,6 +2839,23 @@ export function createEngine(deps: EngineDeps): Engine {
           st.metaTimer = null
           await writeBinding(st).catch(() => {})
         }
+        // URL-at-exit barrier: a very short `opencode run` can exit before
+        // the create handshake finishes, and CI reads the urlFile the
+        // moment the process ends. Bounded 5s wait for every share that is
+        // mid-handshake or not yet announced (a dead worker costs exactly
+        // the cap; a healthy one is instant).
+        const barrierStart = Date.now()
+        while (Date.now() - barrierStart < 5000) {
+          let pendingAnnounce = false
+          for (const st of sessions.values()) {
+            for (const r of st.remotes.values()) {
+              if (r.authBlocked || r.collided) continue
+              if ((r.shareId && !r.announced) || (!r.shareId && (r.ws || r.connecting))) pendingAnnounce = true
+            }
+          }
+          if (!pendingAnnounce) break
+          await new Promise((res) => setTimeout(res, 100))
+        }
         for (const st of sessions.values()) {
           for (const r of st.remotes.values()) {
             try {

package/src/settings.ts

@@ -28,8 +28,10 @@ import {
   runUnshareFlow,
   saveConfig,
   saveServerEntry,
+  meClient,
   serverEntries,
   setShareFlag,
+  setShareOpts,
   shareWithConsent,
   workerDeleteShare,
   type AdminShare,
@@ -113,11 +115,11 @@ const LABELS: Record<string, LabelMeta> = {
   },
   shareMode: {
     label: "Share mode",
-    help: '"all" shares every session; "manual" needs /share. Default: TUI presence.',
+    help: '"all" shares every session; "manual" needs /share. Default: TUI presence. Takes effect after opencode restarts.',
     kind: "text",
     options: ["auto", "all", "manual"],
     section: "Sharing",
-    info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared — share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides — installing the TUI part means manual, server-only means all.',
+    info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared - share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides - installing the TUI part means manual, server-only means all.\n\nNOTE: the mode is resolved once at plugin load. Changing it here saves immediately but only takes effect after opencode restarts - until then new sessions keep following the OLD mode.',
     def: "auto (TUI presence)",
   },
   debounceMs: {
@@ -152,15 +154,6 @@ const LABELS: Record<string, LabelMeta> = {
     info: "How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.\n\nA per-session override lives in the This-session section; it is sent at create/attach time.",
     def: "worker cap (90 on the reference deployment)",
   },
-  openTasksInNewTab: {
-    label: "Open tasks in new tab",
-    help: "Viewer: task rows open subagent pages in a new tab.",
-    kind: "text",
-    options: ["true", "false"],
-    section: "Sharing",
-    info: "Viewer behavior only: clicking a task (subagent) row opens its sub-page in a new browser tab instead of navigating. true/false.",
-    def: "true",
-  },
   authLogin: {
     label: "Read auth: login",
     help: "Optional read gate for share pages. Empty removes protection on the next attach.",
@@ -218,8 +211,7 @@ function helpForKey(key: string, cfg: ShareConfig, sources: Record<string, strin
 
 function displayValue(key: string, cfg: ShareConfig): string {
   if (key === "createToken" || key === "authPassword") return mask(String(cfg[key] ?? ""))
-  if (key === "openTasksInNewTab") return String(cfg.openTasksInNewTab !== false)
-  if (key === "announceStderr") return String(cfg.announceStderr !== false)
+  if (key === "announceStderr") return cfg.announceStderr !== false ? "on" : "off"
   const value = (cfg as unknown as Record<string, unknown>)[key]
   return value === undefined || value === "" ? "(not set)" : String(value)
 }
@@ -243,7 +235,7 @@ async function editKey(host: ShareHostApi, cfg: ShareConfig, key: string): Promi
     if (picked === undefined) return undefined
     const next = { ...cfg } as unknown as Record<string, unknown>
     if (key === "shareMode") next[key] = picked === "auto" ? undefined : picked
-    else if (key === "openTasksInNewTab" || key === "announceStderr") next[key] = picked === "true"
+    else if (key === "announceStderr") next[key] = picked === "true"
     else next[key] = picked
     return next as ShareConfig
   }
@@ -330,6 +322,7 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
     }
     if (!mine.entry.token || holdsRoot) options.push({ title: "Enroll now", value: "enroll", description: holdsRoot ? "join as a user via code/public enrollment" : "get a user token immediately" })
     if (mine.entry.token && !holdsRoot) options.push({ title: "Rotate token", value: "rotate", description: "new token, old one revoked" })
+    if (mine.entry.token && !holdsRoot) options.push({ title: "Your account", value: "account", description: "limits, token expiry, your shares" })
     if (mine.entry.token && !holdsRoot) options.push({ title: "Disconnect", value: "disconnect", description: "revoke the token server-side and forget it", danger: true })
     options.push({
       title: "Admin panel",
@@ -345,11 +338,16 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
     if (choice === undefined || choice === "__back") return
 
     if (choice === "active") {
-      for (const other of entries) {
-        if (other.url !== url) saveServerEntry(other.url, { active: undefined })
-      }
+      // make-primary WITHOUT collapsing fan-out: other explicit actives
+      // stay active (the engine targets every active entry); silently
+      // deactivating them destroyed hand-built multi-server setups
       saveServerEntry(url, { active: true })
-      host.ui.toast({ variant: "success", title: "OpenShare", message: `${url} is now the active server.` })
+      const stillActive = serverEntries().filter((s) => s.active)
+      host.ui.toast({
+        variant: "success",
+        title: "OpenShare",
+        message: stillActive.length > 1 ? `${url} is primary - ${stillActive.length} servers stay ACTIVE (fan-out): new sessions mirror to all of them.` : `${url} is now the active server.`,
+      })
       return
     }
     if (choice === "adopt") {
@@ -398,6 +396,30 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
       }
       continue
     }
+    if (choice === "account") {
+      const me = meClient(url, mine.entry.token ?? "")
+      const [meRes, sharesRes] = await Promise.all([me.me(), me.myShares()])
+      if (!meRes.ok) {
+        await showInfo(host.ui, { title: "Account", message: `Could not read your account: ${meRes.error ?? "error"}.\nIf the token was revoked server-side, use Enroll now instead.` })
+        continue
+      }
+      const d = meRes.data!
+      const lim = d.token?.limits ?? {}
+      const fmt = (v: number | undefined) => (v ? String(v) : "unlimited")
+      const lines = [
+        `User: ${d.label} (${d.userId})`,
+        `Token: ${d.token?.label ?? "?"} - expires ${d.token?.expiresAt ? new Date(d.token.expiresAt).toISOString().slice(0, 10) : "never"}`,
+        `Limits: live shares ${fmt(lim.maxLiveShares)} - max TTL ${fmt(lim.maxTtlDays)}d - daily creates ${fmt(lim.dailyCreates)}`,
+      ]
+      if (sharesRes.ok) {
+        const shares = sharesRes.data?.shares ?? []
+        lines.push(`Shares: ${shares.length} (${shares.filter((s) => s.status === "live").length} live)`)
+        for (const s of shares.slice(0, 10)) lines.push(`  ${s.id} - ${s.status} - ${new Date(s.createdAt).toISOString().slice(0, 10)}`)
+        if (shares.length > 10) lines.push(`  ...and ${shares.length - 10} more`)
+      }
+      await showInfo(host.ui, { title: "Your account", message: lines.join("\n") })
+      continue
+    }
     if (choice === "rotate") {
       const res = await rotateAtServer(url, mine.entry.token ?? "")
       if (res.ok && res.token) {
@@ -409,7 +431,12 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
       continue
     }
     if (choice === "disconnect") {
-      const sure = await showConfirm(host.ui, { title: "Disconnect", message: `Revoke the token at ${url} and forget it?\nYour shares stay (read-only for you until TTL).`, confirmLabel: "Disconnect", danger: true })
+      const sure = await showConfirm(host.ui, {
+        title: "Disconnect",
+        message: `Revoke the token at ${url} and forget it?\nRevoking your last token freezes control of ALL your shares there (even with the share secrets) - pages stay readable until their TTL; only the server admin can restore control.`,
+        confirmLabel: "Disconnect",
+        danger: true,
+      })
       if (!sure) continue
       const res = await disconnectAtServer(url, mine.entry.token ?? "")
       saveServerEntry(url, { token: undefined })
@@ -821,7 +848,7 @@ async function adminSharesMenu(host: ShareHostApi, client: ReturnType<typeof adm
  * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
  * Save semantics unchanged: root Exit saves when dirty; submenu Back
  * just returns. */
-export async function settingsDialog(host: ShareHostApi, startAtSession?: string): Promise<void> {
+export async function settingsDialog(host: ShareHostApi, startAtSession?: string, startGroup?: "session"): Promise<void> {
   let cfg = currentConfig()
   let dirty = false
   // Write target (owner rule): global settings home by default; any other
@@ -981,17 +1008,23 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
       }
     }
     const binding = bindings[0]
+    if (binding?.lastError || binding?.ttlClamped) {
+      const bits: string[] = []
+      if (binding?.ttlClamped) bits.push(`TTL clamped ${binding.ttlClamped.requested}d -> ${binding.ttlClamped.effective}d by server/token policy`)
+      if (binding?.lastError) bits.push(`last share error: ${binding.lastError}`)
+      rows.push({ title: "Share status notes", value: "__notes", description: bits[0].slice(0, 60), disabled: true, help: `Engine-recorded notes for this session's share(s):\n\n${bits.join("\n")}\n\nThe clamp note appears when the server or your token's policy reduced a requested TTL. The error note is the engine's last create/attach refusal (quota, freeze, rate limit) - it clears on the next successful sync.` })
+    }
     rows.push({
       title: "Session TTL override (days)",
       value: "session:ttl",
       description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-      help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. Applied at the next create/attach.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
+      help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
     })
     rows.push({
       title: "Session read auth",
       value: "session:auth",
       description: binding?.opts?.authLogin ? `${binding.opts.authLogin} / ****` : "(config default)",
-      help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth. Applied at the next create/attach; removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
+      help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth; a login and password are both required (or neither). On a live share it applies immediately; otherwise when you share. Removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
     })
     return rows
   }
@@ -1177,9 +1210,11 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
           options: [...otherServers.map((s) => ({ title: hostOf(s.url), value: s.url, description: s.entry.label })), { title: "Cancel", value: "__cancel" }],
         })
         if (!pick || pick === "__cancel") return
-        for (const s of serverEntries()) if (s.url !== pick) saveServerEntry(s.url, { active: undefined })
+        // fan-out add: activate the picked server WITHOUT deactivating the
+        // current ones - this session (and new sessions) mirror everywhere
         saveServerEntry(pick, { active: true })
-        host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated — this session mirrors there within seconds.` })
+        const nActive = serverEntries().filter((s) => s.active).length
+        host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated (${nActive} active) - this session mirrors there within seconds.` })
         return
       }
       if (choice === "session:unshare") {
@@ -1193,17 +1228,27 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
         })
         if (how === undefined || how === "__cancel") return
         if (how === "leave") {
-          const all = await readBindings(host.client, root)
+          const allB = await readBindings(host.client, root)
           const okPatch = await patchSessionBinding(host.client, root, (servers) => {
-            for (const b of all) {
+            for (const b of allB) {
               if (!b.server) continue
-              delete servers[b.server]
-              servers[b.server] = { optedOut: true }
+              // keep id/secret on the opt-out marker: the snapshot stays
+              // deletable later and re-sharing reuses the binding instead
+              // of stalling on a secret-less marker (live-caught as "can
+              // never unshare or re-share after leave-as-is")
+              servers[b.server] = { ...(servers[b.server] as Record<string, unknown> | undefined), id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true }
             }
           })
-          host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs." : "Could not update the binding." })
+          host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs (delete stays available here)." : "Could not update the binding." })
           return
         }
+        const sureAll = await showConfirm(host.ui, {
+          title: "Delete every page?",
+          message: `Permanently delete ${live.length} share page(s) and stop sharing?\nEvery link stops working for everyone. This cannot be undone.`,
+          confirmLabel: "Delete every page",
+          danger: true,
+        })
+        if (!sureAll) return
         const result = await runUnshareFlow(host, startAtSession)
         host.ui.toast({ variant: result.ok ? "success" : "error", title: "OpenShare", message: result.message })
         return
@@ -1221,26 +1266,39 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
           }
           opts.ttlDays = Math.floor(days)
         }
-        await setShareFlag(host.client, root, opts)
-        host.ui.toast({ variant: "success", title: "OpenShare", message: opts.ttlDays !== undefined ? `Session TTL: ${opts.ttlDays}d (applies at the next attach/create)` : "Session TTL override cleared" })
+        await setShareOpts(host.client, root, opts)
+        const liveNow = live.length > 0
+        host.ui.toast({
+          variant: "success",
+          title: "OpenShare",
+          message: liveNow
+            ? `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
+            : `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d` : "(default)"} - saved, applies when you share.`,
+        })
         return
       }
       if (choice === "session:auth") {
-        const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = use config default", value: current?.opts?.authLogin ?? "" })
+        const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = no read auth", value: current?.opts?.authLogin ?? "" })
         if (login === undefined) return
-        const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: "empty = no password" })
+        const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: login === "" ? "(unused)" : "password (required with a login)" })
         if (password === undefined) return
+        // both-or-none: the server builds a gate only from a full pair, and
+        // rendering half a pair would show protection that does not exist
+        if ((login === "") !== (password === "")) {
+          host.ui.toast({ variant: "error", title: "OpenShare", message: "Read auth needs both a login and a password - or neither (no gate)." })
+          return
+        }
         const opts: SessionOpts = { ...(current?.opts ?? {}) }
         if (login === "") {
           delete opts.authLogin
           delete opts.authPassword
         } else {
           opts.authLogin = login
-          if (password !== "") opts.authPassword = password
-          else delete opts.authPassword
+          opts.authPassword = password
         }
-        await setShareFlag(host.client, root, opts)
-        host.ui.toast({ variant: "success", title: "OpenShare", message: "Session read auth saved (applies at the next attach/create)." })
+        await setShareOpts(host.client, root, opts)
+        const liveNow2 = live.length > 0
+        host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` })
         return
       }
     }
@@ -1261,6 +1319,10 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
 
   // ---- root: compact group list with live summaries --------------------------
 
+  // /share on a shared session lands HERE, straight in the session menu -
+  // one selection sooner (Back still reaches the full root)
+  if (startAtSession && startGroup === "session") await groupMenu("session")
+
   const seconds = (ms: number | undefined, fallback: number) => `${Math.round((ms ?? fallback) / 100) / 10}s`
   while (true) {
     const servers = serverEntries(cfg)