@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/src/settings.ts

@@ -15,12 +15,15 @@ import {
   deleteServerEntry,
   disconnectAtServer,
   enrollAtServer,
+  fmtHours,
+  parseTtlHours,
   hostOf,
   isConfigured,
   normServerUrl,
   probeAuthMode,
   probeWorker,
   patchSessionBinding,
+  patchShareOpts,
   readBinding,
   readBindings,
   resolveRoot,
@@ -28,8 +31,10 @@ import {
   runUnshareFlow,
   saveConfig,
   saveServerEntry,
+  meClient,
   serverEntries,
   setShareFlag,
+  setShareOpts,
   shareWithConsent,
   workerDeleteShare,
   type AdminShare,
@@ -113,11 +118,11 @@ const LABELS: Record<string, LabelMeta> = {
   },
   shareMode: {
     label: "Share mode",
-    help: '"all" shares every session; "manual" needs /share. Default: TUI presence.',
+    help: '"all" shares every session; "manual" needs /share. Default: TUI presence. Takes effect after opencode restarts.',
     kind: "text",
     options: ["auto", "all", "manual"],
     section: "Sharing",
-    info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared — share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides — installing the TUI part means manual, server-only means all.',
+    info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared - share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides - installing the TUI part means manual, server-only means all.\n\nNOTE: the mode is resolved once at plugin load. Changing it here saves immediately but only takes effect after opencode restarts - until then new sessions keep following the OLD mode.',
     def: "auto (TUI presence)",
   },
   debounceMs: {
@@ -144,22 +149,13 @@ const LABELS: Record<string, LabelMeta> = {
     info: 'How the model name appears on the share page. "$Provider/$Model" renders e.g. "closedrouter/zai/glm-5.3". Any literal text is used as-is; empty string hides the model line entirely.',
     def: '"$Provider/$Model"',
   },
-  ttlDays: {
-    label: "TTL (days)",
-    help: "Share lifetime; the worker caps it at its MAX_TTL_DAYS.",
+  ttlHours: {
+    label: "TTL (hours)",
+    help: "Share lifetime in hours (2d writes 48); capped server-side.",
     kind: "number",
     section: "Sharing",
-    info: "How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.\n\nA per-session override lives in the This-session section; it is sent at create/attach time.",
-    def: "worker cap (90 on the reference deployment)",
-  },
-  openTasksInNewTab: {
-    label: "Open tasks in new tab",
-    help: "Viewer: task rows open subagent pages in a new tab.",
-    kind: "text",
-    options: ["true", "false"],
-    section: "Sharing",
-    info: "Viewer behavior only: clicking a task (subagent) row opens its sub-page in a new browser tab instead of navigating. true/false.",
-    def: "true",
+    info: "How long pages live before the server's sweeper deletes them, in HOURS. Capped server-side: the deployment's MAX_TTL_HOURS (legacy MAX_TTL_DAYS converted) and the token's limit both apply; the floor is one hour.\n\nA per-session override lives in the This-session section; it is sent at create/attach time. The session prompt takes 6h / 2d style input.",
+    def: "worker cap (2160h = 90d on the reference deployment)",
   },
   authLogin: {
     label: "Read auth: login",
@@ -218,8 +214,7 @@ function helpForKey(key: string, cfg: ShareConfig, sources: Record<string, strin
 
 function displayValue(key: string, cfg: ShareConfig): string {
   if (key === "createToken" || key === "authPassword") return mask(String(cfg[key] ?? ""))
-  if (key === "openTasksInNewTab") return String(cfg.openTasksInNewTab !== false)
-  if (key === "announceStderr") return String(cfg.announceStderr !== false)
+  if (key === "announceStderr") return cfg.announceStderr !== false ? "on" : "off"
   const value = (cfg as unknown as Record<string, unknown>)[key]
   return value === undefined || value === "" ? "(not set)" : String(value)
 }
@@ -227,8 +222,8 @@ function displayValue(key: string, cfg: ShareConfig): string {
 async function editKey(host: ShareHostApi, cfg: ShareConfig, key: string): Promise<ShareConfig | undefined> {
   const meta = LABELS[key]
   if (!meta) return undefined
-  // selection-backed settings (owner: "setting share mode i need to enter it
-  // manually? No selection?") — fixed vocabularies become menus
+  // selection-backed settings: fixed vocabularies become menus instead of
+  // asking for a typed value
   if (meta.options) {
     const current = String((cfg as unknown as Record<string, unknown>)[key] ?? "")
     const picked = await showSelect(host.ui, {
@@ -243,7 +238,7 @@ async function editKey(host: ShareHostApi, cfg: ShareConfig, key: string): Promi
     if (picked === undefined) return undefined
     const next = { ...cfg } as unknown as Record<string, unknown>
     if (key === "shareMode") next[key] = picked === "auto" ? undefined : picked
-    else if (key === "openTasksInNewTab" || key === "announceStderr") next[key] = picked === "true"
+    else if (key === "announceStderr") next[key] = picked === "true"
     else next[key] = picked
     return next as ShareConfig
   }
@@ -270,39 +265,91 @@ async function editKey(host: ShareHostApi, cfg: ShareConfig, key: string): Promi
   return next as ShareConfig
 }
 
-/** Connect (add + enroll) a server — the /share first-run flow and the
+/** Connect (add + enroll) a server - the /share first-run flow and the
  * settings "Connect to a server" row share it. Prompts the URL, probes
- * the auth mode, prompts a code for private servers, enrolls, persists
- * the token and makes it the active server. */
+ * the auth mode, then ASKS ONCE: onboard to an account, or stay anonymous
+ * (public servers only; anonymous shares sit under the server's global
+ * caps). Onboarding detects whether a code is needed and only then prompts
+ * for one (a code already in config is used without asking). The outcome is
+ * remembered per server: a token means onboarded, an anonymous flag means
+ * declined. */
 export async function connectServerFlow(host: ShareHostApi): Promise<{ ok: boolean; message: string; url?: string }> {
   const raw = await showPrompt(host.ui, { title: "Share server URL", placeholder: "https://your-openshare-host" })
   if (raw === undefined || raw === "") return { ok: false, message: "Cancelled." }
   const url = normServerUrl(raw)
   if (!/^https?:\/\//.test(url)) return { ok: false, message: "URL must start with http:// or https://" }
-  host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}…` })
+  host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}:` })
   const probe = await probeAuthMode(url)
   if (!probe.ok) return { ok: false, message: `${url}: ${probe.detail}` }
-  let code = ""
-  if (probe.mode === "private") {
-    const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" })
-    if (typed === undefined) return { ok: false, message: "Cancelled — private servers need a code." }
+  const existing = serverEntries().find((sv) => sv.url === url)?.entry ?? {}
+  const deactivateOthers = () => {
+    for (const other of serverEntries()) {
+      if (other.url !== url) saveServerEntry(other.url, { active: undefined })
+    }
+  }
+  if (probe.mode === "public") {
+    // the ask: an account is a real thing (own shares, own limits,
+    // revocable credentials) - but anonymous sharing works too
+    const picked = await showSelect(host.ui, {
+      title: `${url} - account?`,
+      options: [
+        {
+          value: "onboard",
+          title: "Onboard (get an account)",
+          description: "your own user, tokens and share limits; survives the server's anonymous caps",
+          help: "An account gives you a revocable identity with your own share registry and limits. Depending on the server you may need a one-time access code from the hoster - you'll be asked only if it's required.",
+        },
+        {
+          value: "anon",
+          title: "Stay anonymous",
+          description: "share without an account; counts against the server-wide anonymous limits",
+          help: "No identity, no token to manage. Shares are ownerless: whoever holds the share's secret controls them, and the server may throttle anonymous creates globally. You can onboard later from Servers -> the server -> Enroll now.",
+        },
+      ],
+    })
+    if (picked === "anon") {
+      saveServerEntry(url, { ...(existing.token ? {} : { anonymous: true }), label: existing.label, active: true })
+      return { ok: true, message: `Connected to ${url} anonymously - sharing works, no account.`, url }
+    }
+    if (picked === undefined || picked === null) return { ok: false, message: "Cancelled." }
+    // onboard: try without a code (codeless servers), fall through to
+    // the code prompt exactly when the server demands one
+    let code = existing.code ?? ""
+    if (!code) {
+      const free = await enrollAtServer(url, "")
+      if (free.ok) {
+        deactivateOthers()
+        saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined, active: true })
+        return { ok: true, message: `Connected to ${url} as "${free.label}" - sharing goes there now.`, url }
+      }
+      const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" })
+      if (typed === undefined) return { ok: false, message: "Cancelled - this server needs a code to onboard." }
+      code = typed.trim()
+    }
+    const res = await enrollAtServer(url, code)
+    if (!res.ok) return { ok: false, message: `Enrollment refused: ${res.error}` }
+    deactivateOthers()
+    saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, anonymous: undefined, active: true })
+    return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url }
+  }
+  // private server: a code is required, full stop
+  let code = existing.code ?? ""
+  if (!code) {
+    const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" })
+    if (typed === undefined) return { ok: false, message: "Cancelled - private servers need a code." }
     code = typed.trim()
   }
   const res = await enrollAtServer(url, code)
   if (!res.ok) return { ok: false, message: `Enrollment refused: ${res.error}` }
-  // single active server: deactivate the others in the settings home,
-  // then persist the new membership as active
-  for (const other of serverEntries()) {
-    if (other.url !== url) saveServerEntry(other.url, { active: undefined })
-  }
+  deactivateOthers()
   saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, active: true })
-  return { ok: true, message: `Connected to ${url} as "${res.label}" — sharing goes there now.`, url }
+  return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url }
 }
 
 /** Per-server submenu: identity status + membership actions. Root-token
- * holders get "Get a user token" (admin mints their own user identity —
- * root stays as adminToken; being admin and being a user are NOT mutually
- * exclusive, live-caught). */
+ * holders get "Get a user token" (the admin mints their own user identity;
+ * root stays as adminToken, since being admin and being a user are not
+ * mutually exclusive). */
 async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
   while (true) {
     const entries = serverEntries()
@@ -315,7 +362,9 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
         ? `token ${mask(mine.entry.token)}`
         : mine.entry.code
           ? "no token (code saved, enrolls on demand)"
-          : "no token (public server, enrolls on demand)"
+          : mine.entry.anonymous
+            ? "anonymous (declined onboarding)"
+            : "no token (public server, shares anonymously)"
     const options: ShareDialogSelectOption<string>[] = [
       { title: url, value: "info", description: `${mine.entry.label ?? "(no label)"} · ${cred}${mine.active ? " · ACTIVE" : ""}`, disabled: true },
     ]
@@ -330,6 +379,7 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
     }
     if (!mine.entry.token || holdsRoot) options.push({ title: "Enroll now", value: "enroll", description: holdsRoot ? "join as a user via code/public enrollment" : "get a user token immediately" })
     if (mine.entry.token && !holdsRoot) options.push({ title: "Rotate token", value: "rotate", description: "new token, old one revoked" })
+    if (mine.entry.token && !holdsRoot) options.push({ title: "Your account", value: "account", description: "limits, token expiry, your shares" })
     if (mine.entry.token && !holdsRoot) options.push({ title: "Disconnect", value: "disconnect", description: "revoke the token server-side and forget it", danger: true })
     options.push({
       title: "Admin panel",
@@ -345,11 +395,16 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
     if (choice === undefined || choice === "__back") return
 
     if (choice === "active") {
-      for (const other of entries) {
-        if (other.url !== url) saveServerEntry(other.url, { active: undefined })
-      }
+      // make-primary WITHOUT collapsing fan-out: other explicit actives
+      // stay active (the engine targets every active entry); silently
+      // deactivating them destroyed hand-built multi-server setups
       saveServerEntry(url, { active: true })
-      host.ui.toast({ variant: "success", title: "OpenShare", message: `${url} is now the active server.` })
+      const stillActive = serverEntries().filter((s) => s.active)
+      host.ui.toast({
+        variant: "success",
+        title: "OpenShare",
+        message: stillActive.length > 1 ? `${url} is primary - ${stillActive.length} servers stay ACTIVE (fan-out): new sessions mirror to all of them.` : `${url} is now the active server.`,
+      })
       return
     }
     if (choice === "adopt") {
@@ -383,21 +438,57 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
         continue
       }
       let code = mine.entry.code ?? ""
-      if (probe.mode === "private" && !code) {
-        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" })
+      if (!code) {
+        // codeless first: only prompt when the server actually demands
+        // a code (public + codeless-on boards silently, like connect)
+        const free = await enrollAtServer(url, "")
+        if (free.ok) {
+          saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined })
+          host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${free.label}".` })
+          continue
+        }
+        if (!/code required/i.test(free.error ?? "")) {
+          await showInfo(host.ui, { title: "Enrollment refused", message: free.error ?? "unknown error" })
+          continue
+        }
+        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" })
         if (typed === undefined) continue
         code = typed.trim()
         if (code) saveServerEntry(url, { code })
       }
       const res = await enrollAtServer(url, code)
       if (res.ok) {
-        saveServerEntry(url, { token: res.token, label: res.label })
+        saveServerEntry(url, { token: res.token, label: res.label, anonymous: undefined })
         host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${res.label}".` })
       } else {
         await showInfo(host.ui, { title: "Enrollment refused", message: res.error ?? "unknown error" })
       }
       continue
     }
+    if (choice === "account") {
+      const me = meClient(url, mine.entry.token ?? "")
+      const [meRes, sharesRes] = await Promise.all([me.me(), me.myShares()])
+      if (!meRes.ok) {
+        await showInfo(host.ui, { title: "Account", message: `Could not read your account: ${meRes.error ?? "error"}.\nIf the token was revoked server-side, use Enroll now instead.` })
+        continue
+      }
+      const d = meRes.data!
+      const lim = d.token?.limits ?? {}
+      const fmt = (v: number | undefined) => (v ? String(v) : "unlimited")
+      const lines = [
+        `User: ${d.label} (${d.userId})`,
+        `Token: ${d.token?.label ?? "?"} - expires ${d.token?.expiresAt ? new Date(d.token.expiresAt).toISOString().slice(0, 10) : "never"}`,
+        `Limits: live shares ${fmt(lim.maxLiveShares)} - max TTL ${fmt(lim.maxTtlDays)}d - daily creates ${fmt(lim.dailyCreates)}`,
+      ]
+      if (sharesRes.ok) {
+        const shares = sharesRes.data?.shares ?? []
+        lines.push(`Shares: ${shares.length} (${shares.filter((s) => s.status === "live").length} live)`)
+        for (const s of shares.slice(0, 10)) lines.push(`  ${s.id} - ${s.status} - ${new Date(s.createdAt).toISOString().slice(0, 10)}`)
+        if (shares.length > 10) lines.push(`  ...and ${shares.length - 10} more`)
+      }
+      await showInfo(host.ui, { title: "Your account", message: lines.join("\n") })
+      continue
+    }
     if (choice === "rotate") {
       const res = await rotateAtServer(url, mine.entry.token ?? "")
       if (res.ok && res.token) {
@@ -409,7 +500,12 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
       continue
     }
     if (choice === "disconnect") {
-      const sure = await showConfirm(host.ui, { title: "Disconnect", message: `Revoke the token at ${url} and forget it?\nYour shares stay (read-only for you until TTL).`, confirmLabel: "Disconnect", danger: true })
+      const sure = await showConfirm(host.ui, {
+        title: "Disconnect",
+        message: `Revoke the token at ${url} and forget it?\nRevoking your last token freezes control of ALL your shares there (even with the share secrets) - pages stay readable until their TTL; only the server admin can restore control.`,
+        confirmLabel: "Disconnect",
+        danger: true,
+      })
       if (!sure) continue
       const res = await disconnectAtServer(url, mine.entry.token ?? "")
       saveServerEntry(url, { token: undefined })
@@ -572,9 +668,9 @@ async function withBusy(host: ShareHostApi, title: string, work: Promise<void> |
   doneBusy?.()
 }
 
-/** Server info, the readable version (live-caught: the raw JSON policy line
- * escaped the dialog border): formatted policy lines, auth explained in
- * words, YOUR standing on this server, and follow-up actions. */
+/** Server info, the readable version (the raw JSON policy line escapes
+ * the dialog border): formatted policy lines, auth explained in words,
+ * YOUR standing on this server, and follow-up actions. */
 async function serverInfoScreen(host: ShareHostApi, url: string, client: ReturnType<typeof adminClient>): Promise<void> {
   const h = await client.health()
   if (!h.ok) {
@@ -817,16 +913,15 @@ async function adminSharesMenu(host: ShareHostApi, client: ReturnType<typeof adm
 }
 
 /** The settings dialog: a compact ROOT of group entries (with live
- * summaries) opening focused submenus. Two-level by design — one flat
- * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
- * Save semantics unchanged: root Exit saves when dirty; submenu Back
- * just returns. */
-export async function settingsDialog(host: ShareHostApi, startAtSession?: string): Promise<void> {
+ * summaries) opening focused submenus. Two-level by design: one flat ~25-row
+ * dump is unreadable. Save semantics unchanged: root Exit saves when dirty;
+ * submenu Back just returns. */
+export async function settingsDialog(host: ShareHostApi, startAtSession?: string, startGroup?: "session"): Promise<void> {
   let cfg = currentConfig()
   let dirty = false
-  // Write target (owner rule): global settings home by default; any other
-  // existing file in the read chain may be chosen explicitly. The TUI
-  // never creates deploy-time override files.
+  // Write target: global settings home by default; any other existing
+  // file in the read chain may be chosen explicitly. The TUI never
+  // creates deploy-time override files.
   const candidates = writeCandidates(moduleDir())
   let writeTarget: WriteCandidate = candidates[0]
   const sources = configSourceMap(moduleDir())
@@ -981,17 +1076,23 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
       }
     }
     const binding = bindings[0]
+    if (binding?.lastError || binding?.ttlClamped) {
+      const bits: string[] = []
+      if (binding?.ttlClamped) bits.push(`TTL clamped ${binding.ttlClamped.requested}d -> ${binding.ttlClamped.effective}d by server/token policy`)
+      if (binding?.lastError) bits.push(`last share error: ${binding.lastError}`)
+      rows.push({ title: "Share status notes", value: "__notes", description: bits[0].slice(0, 60), disabled: true, help: `Engine-recorded notes for this session's share(s):\n\n${bits.join("\n")}\n\nThe clamp note appears when the server or your token's policy reduced a requested TTL. The error note is the engine's last create/attach refusal (quota, freeze, rate limit) - it clears on the next successful sync.` })
+    }
     rows.push({
       title: "Session TTL override (days)",
       value: "session:ttl",
-      description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-      help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. Applied at the next create/attach.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
+      description: binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(worker default)",
+      help: `Per-session share lifetime in HOURS (prompt accepts 6h / 2d / 48). Overrides the config TTL for THIS session's pages; still capped server-side. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(none — config default)"}`,
     })
     rows.push({
       title: "Session read auth",
       value: "session:auth",
       description: binding?.opts?.authLogin ? `${binding.opts.authLogin} / ****` : "(config default)",
-      help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth. Applied at the next create/attach; removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
+      help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth; a login and password are both required (or neither). On a live share it applies immediately; otherwise when you share. Removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
     })
     return rows
   }
@@ -1177,9 +1278,11 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
           options: [...otherServers.map((s) => ({ title: hostOf(s.url), value: s.url, description: s.entry.label })), { title: "Cancel", value: "__cancel" }],
         })
         if (!pick || pick === "__cancel") return
-        for (const s of serverEntries()) if (s.url !== pick) saveServerEntry(s.url, { active: undefined })
+        // fan-out add: activate the picked server WITHOUT deactivating the
+        // current ones - this session (and new sessions) mirror everywhere
         saveServerEntry(pick, { active: true })
-        host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated — this session mirrors there within seconds.` })
+        const nActive = serverEntries().filter((s) => s.active).length
+        host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated (${nActive} active) - this session mirrors there within seconds.` })
         return
       }
       if (choice === "session:unshare") {
@@ -1193,54 +1296,89 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
         })
         if (how === undefined || how === "__cancel") return
         if (how === "leave") {
-          const all = await readBindings(host.client, root)
+          const allB = await readBindings(host.client, root)
           const okPatch = await patchSessionBinding(host.client, root, (servers) => {
-            for (const b of all) {
+            for (const b of allB) {
               if (!b.server) continue
-              delete servers[b.server]
-              servers[b.server] = { optedOut: true }
+              // keep id/secret on the opt-out marker: the snapshot stays
+              // deletable later, and re-sharing reuses the binding instead
+              // of stalling on a secret-less marker that can never unshare
+              // or re-share again.
+              servers[b.server] = { ...(servers[b.server] as Record<string, unknown> | undefined), id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true }
             }
           })
-          host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs." : "Could not update the binding." })
+          host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs (delete stays available here)." : "Could not update the binding." })
           return
         }
+        const sureAll = await showConfirm(host.ui, {
+          title: "Delete every page?",
+          message: `Permanently delete ${live.length} share page(s) and stop sharing?\nEvery link stops working for everyone. This cannot be undone.`,
+          confirmLabel: "Delete every page",
+          danger: true,
+        })
+        if (!sureAll) return
         const result = await runUnshareFlow(host, startAtSession)
         host.ui.toast({ variant: result.ok ? "success" : "error", title: "OpenShare", message: result.message })
         return
       }
       if (choice === "session:ttl") {
-        const raw = await showPrompt(host.ui, { title: "Session TTL (days)", placeholder: "days", value: current?.opts?.ttlDays !== undefined ? String(current.opts.ttlDays) : "" })
+        const raw = await showPrompt(host.ui, { title: "Session TTL", placeholder: "hours: 6h, 2d or 48", value: current?.opts?.ttlHours !== undefined ? fmtHours(current.opts.ttlHours) : "" })
         if (raw === undefined) return
         const opts: SessionOpts = { ...(current?.opts ?? {}) }
-        if (raw === "") delete opts.ttlDays
+        if (raw === "") delete opts.ttlHours
         else {
-          const days = Number(raw)
-          if (!Number.isFinite(days) || days <= 0) {
-            host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be a positive number of days." })
+          const hours = parseTtlHours(raw)
+          if (hours === undefined) {
+            host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be 6h / 2d style or a positive number of hours." })
             return
           }
-          opts.ttlDays = Math.floor(days)
+          opts.ttlHours = hours
         }
-        await setShareFlag(host.client, root, opts)
-        host.ui.toast({ variant: "success", title: "OpenShare", message: opts.ttlDays !== undefined ? `Session TTL: ${opts.ttlDays}d (applies at the next attach/create)` : "Session TTL override cleared" })
+        await setShareOpts(host.client, root, opts)
+        const liveNow = live.length > 0
+        if (liveNow) {
+          // REST push (#13): immediate on every server, socket or not
+          const results = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, opts.ttlHours !== undefined ? { ttlHours: opts.ttlHours } : {}, b.secret) : Promise.resolve({ ok: false })))
+          const failed = results.filter((r) => !r.ok).length
+          if (failed) host.ui.toast({ variant: "error", title: "OpenShare", message: `TTL applied on ${results.length - failed}/${results.length} server(s) - the rest sync on next connect.` })
+        }
+        host.ui.toast({
+          variant: "success",
+          title: "OpenShare",
+          message: liveNow
+            ? `Session TTL: ${opts.ttlHours !== undefined ? `${fmtHours(opts.ttlHours)} - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
+            : `Session TTL: ${opts.ttlHours !== undefined ? fmtHours(opts.ttlHours) : "(default)"} - saved, applies when you share.`,
+        })
         return
       }
       if (choice === "session:auth") {
-        const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = use config default", value: current?.opts?.authLogin ?? "" })
+        const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = no read auth", value: current?.opts?.authLogin ?? "" })
         if (login === undefined) return
-        const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: "empty = no password" })
+        const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: login === "" ? "(unused)" : "password (required with a login)" })
         if (password === undefined) return
+        // both-or-none: the server builds a gate only from a full pair, and
+        // rendering half a pair would show protection that does not exist
+        if ((login === "") !== (password === "")) {
+          host.ui.toast({ variant: "error", title: "OpenShare", message: "Read auth needs both a login and a password - or neither (no gate)." })
+          return
+        }
         const opts: SessionOpts = { ...(current?.opts ?? {}) }
         if (login === "") {
           delete opts.authLogin
           delete opts.authPassword
         } else {
           opts.authLogin = login
-          if (password !== "") opts.authPassword = password
-          else delete opts.authPassword
+          opts.authPassword = password
         }
-        await setShareFlag(host.client, root, opts)
-        host.ui.toast({ variant: "success", title: "OpenShare", message: "Session read auth saved (applies at the next attach/create)." })
+        await setShareOpts(host.client, root, opts)
+        const liveNow2 = live.length > 0
+        if (liveNow2) {
+          const pair = login === "" ? { authLogin: "", authPassword: "" } : { authLogin: login, authPassword: password }
+          const results2 = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, pair, b.secret) : Promise.resolve({ ok: false })))
+          const failed2 = results2.filter((r) => !r.ok).length
+          if (failed2) host.ui.toast({ variant: "error", title: "OpenShare", message: `Read auth applied on ${results2.length - failed2}/${results2.length} server(s) - the rest sync on next connect.` })
+        }
+        host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` })
         return
       }
     }
@@ -1261,6 +1399,10 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
 
   // ---- root: compact group list with live summaries --------------------------
 
+  // /share on a shared session lands HERE, straight in the session menu -
+  // one selection sooner (Back still reaches the full root)
+  if (startAtSession && startGroup === "session") await groupMenu("session")
+
   const seconds = (ms: number | undefined, fallback: number) => `${Math.round((ms ?? fallback) / 100) / 10}s`
   while (true) {
     const servers = serverEntries(cfg)
@@ -1288,7 +1430,7 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
     })
     groups.push({
       id: "sharing",
-      summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${cfg.ttlDays ?? "server cap"}`,
+      summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${fmtHours(cfg.ttlHours ?? 2160)}`,
       help: `What and how sessions stream: share mode (all/manual), sync cadence, the completed-delay, the model label on pages, share TTL, and the viewer's task-tab behavior.\n\nCadence values are clamped by the server's policy window.`,
     })
     groups.push({