@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/src/share-flow.ts

@@ -17,7 +17,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs"
 import { loadConfig, moduleDir, configPaths, configHomePath, resolveServer, saveServerEntry, deleteServerEntry, METADATA_KEY, type ShareConfig, type ServerEntry } from "./config.js"
 import { dbg, dbgLog } from "./sidebar.js"
-import type { ClientApi, SessionInfo, SessionOpts } from "./core.js"
+import { engineTargetUrls, sessionStatsFor, type ClientApi, type SessionInfo, type SessionOpts } from "./core.js"
 import { queueBindingWrite } from "./binding-queue.js"
 import type { ShareHostApi } from "./tui-host.js"
 
@@ -28,6 +28,12 @@ export type SessionBinding = {
   url: string
   enabled?: boolean
   opts?: SessionOpts
+  /** per-server "leave as-is" marker: a snapshot, not a live mirror */
+  optedOut?: boolean
+  /** engine-recorded last create/attach refusal (quota, frozen, ...) */
+  lastError?: string
+  /** server policy clamped the requested TTL */
+  ttlClamped?: { requested: number; effective: number }
 }
 
 export function pluginConfigPaths(baseDir: string = moduleDir()): string[] {
@@ -38,11 +44,10 @@ export function currentConfig(baseDir: string = moduleDir()): ShareConfig {
   return loadConfig(baseDir)
 }
 
-/** Writes the config file. Target rule (owner-directed): the global
- * settings home by default, or an explicit existing file chosen in the
- * TUI — NEVER "first existing in the read chain" (that wrote TUI edits
- * into the tracked adjacent template, live-caught). $comment and foreign
- * keys preserved. */
+/** Writes the config file. Target rule: the global settings home by
+ * default, or an explicit existing file chosen in the TUI, never "first
+ * existing in the read chain" (that writes TUI edits into the tracked
+ * adjacent template). $comment and foreign keys preserved. */
 export function saveConfig(cfg: ShareConfig, target?: string, baseDir: string = moduleDir()): { path: string } | undefined {
   const path = target ?? configHomePath()
   if (!path) return undefined
@@ -65,8 +70,7 @@ export function saveConfig(cfg: ShareConfig, target?: string, baseDir: string =
       "debounceMs",
       "completedDelayMs",
       "modelLabel",
-      "ttlDays",
-      "openTasksInNewTab",
+      "ttlHours",
       "authLogin",
       "authPassword",
       "spoolDir",
@@ -100,8 +104,10 @@ export function serverEntries(cfg: ShareConfig = currentConfig()): Array<{ url:
   if (cfg.workerUrl) merged[cfg.workerUrl] = { token: cfg.createToken || "", active: true }
   if (cfg.servers) for (const [url, entry] of Object.entries(cfg.servers)) merged[url] = { ...merged[url], ...entry }
   const urls = Object.keys(merged)
-  const activeUrl = urls.find((u) => merged[u].active) ?? urls[0]
-  return urls.map((url) => ({ url, entry: merged[url], active: url === activeUrl }))
+  // EVERY explicit active is active (the engine fans out to all of them);
+  // only when none is marked does the first entry act as the default
+  const anyActive = urls.some((u) => merged[u].active)
+  return urls.map((url) => ({ url, entry: merged[url], active: anyActive ? merged[url].active === true : url === urls[0] }))
 }
 
 export { saveServerEntry, deleteServerEntry }
@@ -115,6 +121,8 @@ export function bindingsOf(info: SessionInfo | undefined): Array<SessionBinding
   const record = raw as Record<string, unknown>
   const opts = (record.opts as SessionOpts | undefined) ?? undefined
   const enabled = record.enabled === true ? true : undefined
+  const lastError = typeof record.lastError === "string" ? record.lastError : undefined
+  const ttlClamped = record.ttlClamped && typeof record.ttlClamped === "object" ? (record.ttlClamped as { requested: number; effective: number }) : undefined
   const out: Array<SessionBinding & { server: string; collided?: string }> = []
   if (record.servers && typeof record.servers === "object") {
     for (const [server, entry] of Object.entries(record.servers as Record<string, unknown>)) {
@@ -131,6 +139,9 @@ export function bindingsOf(info: SessionInfo | undefined): Array<SessionBinding
         opts,
         server,
         collided,
+        optedOut: e.optedOut === true ? true : undefined,
+        lastError,
+        ttlClamped,
       })
     }
     return out
@@ -147,6 +158,8 @@ export function bindingsOf(info: SessionInfo | undefined): Array<SessionBinding
       opts,
       server: "",
       collided,
+      lastError,
+      ttlClamped,
     })
   }
   return out
@@ -157,6 +170,24 @@ export async function readBindings(client: ClientApi | undefined, sid: string):
   return bindingsOf(await getSession(client, sid))
 }
 
+/** Human TTL from hours: "6h", "2d", "90d" (the TUI prompt accepts
+ * these same shapes back). */
+export function fmtHours(hours: number): string {
+  if (!Number.isFinite(hours) || hours <= 0) return "?"
+  if (hours % 24 === 0) return `${Math.floor(hours / 24)}d`
+  return `${Math.floor(hours)}h`
+}
+
+/** Parse "6h" / "2d" / "48" into hours (bare number = hours). */
+export function parseTtlHours(raw: string): number | undefined {
+  const m = /^\s*(\d+(?:\.\d+)?)\s*(h|d|hr|hours?|days?)?\s*$/i.exec(raw ?? "")
+  if (!m) return undefined
+  const v = Number(m[1])
+  if (!Number.isFinite(v) || v <= 0) return undefined
+  const unit = (m[2] ?? "h").toLowerCase()
+  return Math.max(1, Math.floor(unit.startsWith("d") ? v * 24 : v))
+}
+
 export function hostOf(url: string): string {
   try {
     return new URL(url).host
@@ -250,7 +281,8 @@ export async function readBinding(client: ClientApi | undefined, sid: string): P
 
 /** Sets metadata.openshare = { ...existing(v2 structure preserved),
  * enabled: true, opts? }. The per-server binding entries are the ENGINE's
- * to manage; the flag just opts the session in. */
+ * to manage; the flag just opts the session in. CONSENT ONLY: every call
+ * here means the user agreed to publish. */
 export async function setShareFlag(
   client: ClientApi | undefined,
   sid: string,
@@ -270,6 +302,30 @@ export async function setShareFlag(
   return patchMetadata(client, sid, metadata)
 }
 
+/** Persists per-session opts WITHOUT touching the enabled state. On an
+ * unshared session the opts sit dormant until a consented create consumes
+ * them; on a live share the engine picks them up and re-syncs the server
+ * (auth/TTL apply immediately). This must never publish anything - the
+ * TTL/auth editors use it, and consent is the only path to enabled. */
+export async function setShareOpts(
+  client: ClientApi | undefined,
+  sid: string,
+  opts: SessionOpts,
+): Promise<boolean> {
+  const info = await getSession(client, sid)
+  if (!info) return false
+  const metadata: Record<string, unknown> = { ...(info.metadata ?? {}) }
+  const existing = info.metadata?.[METADATA_KEY]
+  const value: Record<string, unknown> =
+    existing && typeof existing === "object"
+      ? { ...(existing as Record<string, unknown>) }
+      : { v: 2, servers: {} }
+  if (Object.keys(opts).length) value.opts = opts
+  else delete value.opts
+  metadata[METADATA_KEY] = value
+  return patchMetadata(client, sid, metadata)
+}
+
 export async function clearShareFlag(client: ClientApi | undefined, sid: string): Promise<boolean> {
   const info = await getSession(client, sid)
   if (!info) return false
@@ -294,6 +350,36 @@ export async function workerDeleteShare(workerUrl: string, id: string, secret: s
   }
 }
 
+/** PATCH a live share's settings over REST (#13): immediate effect with
+ * no socket required (the engine's attach-sync remains the structural
+ * path - this is the same edit pushed now, per server). Auth sends as
+ * the both-or-none pair or not at all; ttlHours only when explicit. */
+export async function patchShareOpts(
+  workerUrl: string,
+  id: string,
+  opts: { authLogin?: string; authPassword?: string; ttlHours?: number },
+  secret: string,
+): Promise<{ ok: boolean; error?: string }> {
+  const body: Record<string, unknown> = { secret }
+  if (opts.authLogin !== undefined && opts.authPassword !== undefined) {
+    body.authLogin = opts.authLogin
+    body.authPassword = opts.authPassword
+  }
+  if (opts.ttlHours !== undefined) body.ttlHours = opts.ttlHours
+  try {
+    const res = await fetch(`${workerUrl.replace(/\/$/, "")}/api/share/${id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(8000),
+    })
+    const json = (await res.json().catch(() => ({}))) as { ok?: boolean; error?: string }
+    return res.ok && json.ok ? { ok: true } : { ok: false, error: json.error ?? `HTTP ${res.status}` }
+  } catch (e) {
+    return { ok: false, error: (e as Error)?.message || String(e) }
+  }
+}
+
 /** Health probe for the settings dialog's connection test. */
 export async function probeWorker(workerUrl: string): Promise<{ ok: boolean; detail: string }> {
   if (!workerUrl) return { ok: false, detail: "workerUrl is empty" }
@@ -456,6 +542,31 @@ export function adminClient(workerUrl: string, token: string) {
   }
 }
 
+/** Self-service client for the /api/me surface (the entry's user osk_
+ * token - NOT the root token). Answers "what are my limits, how many
+ * shares do I have, when does my token expire". */
+export function meClient(workerUrl: string, token: string) {
+  const base = normServerUrl(workerUrl)
+  const call = async <T>(method: string, path: string): Promise<{ ok: boolean; status: number; data?: T; error?: string }> => {
+    try {
+      const res = await fetch(`${base}${path}`, {
+        method,
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(12000),
+      })
+      const parsed = (await res.json().catch(() => ({}))) as T & { ok?: boolean; error?: string }
+      if (!res.ok) return { ok: false, status: res.status, error: parsed?.error ?? `HTTP ${res.status}` }
+      return { ok: parsed?.ok !== false, status: res.status, data: parsed, error: parsed?.error }
+    } catch (error) {
+      return { ok: false, status: 0, error: (error as Error).message }
+    }
+  }
+  return {
+    me: () => call<{ userId: string; label: string; token: { id: string; label: string; limits: Record<string, number>; expiresAt: number }; settings: Record<string, unknown> }>("GET", "/api/me"),
+    myShares: () => call<{ shares: Array<{ id: string; sessionID: string; createdAt: number; status: string }> }>("GET", "/api/me/shares"),
+  }
+}
+
 /** Resolve the admin credential for a server: the entry's adminToken, the
  * legacy createToken (when it points at this server), or prompt. */
 export function adminTokenFor(url: string, cfg: ShareConfig = currentConfig()): string {
@@ -487,11 +598,23 @@ export async function waitForBinding(
 export type FlowResult = { ok: boolean; message: string; url?: string; unconfigured?: boolean }
 
 /** Consent gate: EVERY share creation asks explicitly (per owner
- * directive — no remembered consent, no silent creates). */
-export async function requestShareConsent(host: ShareHostApi): Promise<boolean> {
+ * directive — no remembered consent, no silent creates). The dialog
+ * carries the live context (server, TTL, gate state) so the decision is
+ * informed, not ceremonial. */
+export async function requestShareConsent(host: ShareHostApi, context?: { server?: string; ttlHours?: number; auth: boolean; counts?: { messages: number; toolCalls: number }; redaction?: { hits: number; samples: string[] } }): Promise<boolean> {
+  const lines: string[] = ["Publish this session (and its subagent sessions) to your openshare worker?"]
+  if (context) {
+    const bits: string[] = []
+    if (context.server) bits.push(`server: ${context.server}`)
+    if (context.ttlHours !== undefined) bits.push(`TTL: ${fmtHours(context.ttlHours)}`)
+    if (context.redaction && context.redaction.hits > 0) bits.push(`redaction: ${context.redaction.hits} hit(s)`)
+    bits.push(`read auth: ${context.auth ? "on" : "off"}`)
+    lines.push(bits.join(" - "))
+  }
+  lines.push("Anyone with the link can read the conversation (login-gated only when read auth is on).")
   return host.ui.showConfirm({
     title: "Share Session",
-    message: "Publish this session (and its subagent sessions) to your openshare worker?\nThe link lets anyone with it read the conversation.",
+    message: lines.join("\n"),
     confirmLabel: "Share",
   })
 }
@@ -502,17 +625,39 @@ export async function requestShareConsent(host: ShareHostApi): Promise<boolean>
 export async function shareWithConsent(host: ShareHostApi, sessionID: string | undefined): Promise<FlowResult> {
   if (!sessionID) return { ok: false, message: "No active session to share." }
   const cfg = currentConfig()
-  if (!isConfigured(cfg)) {
-    return { ok: false, message: "No share server connected — run /openshare to connect one.", unconfigured: true }
+  // engine-aware: plugin-options-layer config can target servers the file
+  // chain cannot see (TUI blindness would push onboarding at a configured user)
+  if (!isConfigured(cfg) && !engineTargetUrls().length) {
+    return { ok: false, message: "No share server connected - run /openshare to connect one.", unconfigured: true }
   }
   const root = await resolveRoot(host.client, sessionID)
-  const existing = await readBinding(host.client, root)
-  if (existing?.url && existing.enabled !== false) {
+  const all = await readBindings(host.client, root)
+  // fully opted-out (leave-as-is everywhere) is NOT live: consent again
+  // instead of silently copying a snapshot link
+  const live = all.find((b) => b.url && b.enabled !== false && !b.optedOut)
+  if (live) {
     // already sharing: copy the link
-    await host.clipboard.write(existing.url)
-    return { ok: true, message: `Share URL copied to clipboard: ${existing.url}`, url: existing.url }
+    await host.clipboard.write(live.url)
+    return { ok: true, message: `Share URL copied to clipboard: ${live.url}`, url: live.url }
+  }
+  const opts = all[0]?.opts
+  const server = serverEntries(cfg).find((s) => s.active) ?? serverEntries(cfg)[0] ?? (engineTargetUrls()[0] ? { url: engineTargetUrls()[0] } : undefined)
+  {
+    const stats = sessionStatsFor(root)
+    const gated = !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword)
+    if (
+      !(await requestShareConsent(host, {
+        server: server ? hostOf(server.url) : undefined,
+        ttlHours: opts?.ttlHours ?? cfg.ttlHours,
+        auth: gated,
+        counts: { messages: stats.messages, toolCalls: stats.toolCalls },
+          // redaction only runs on ungated shares (a gated share is
+        // private from casual observers; the ledger reflects that)
+        redaction: gated ? undefined : { hits: stats.redaction.count, samples: stats.redaction.samples.map((h) => `${h.sample} [${h.kind}]`) },
+      }))
+    )
+      return { ok: false, message: "Share cancelled." }
   }
-  if (!(await requestShareConsent(host))) return { ok: false, message: "Share cancelled." }
   return confirmShare(host, root)
 }
 
@@ -522,13 +667,25 @@ export async function confirmShare(host: ShareHostApi, rootSessionID: string): P
   const set = await setShareFlag(host.client, rootSessionID)
   dbgLog(`confirmShare: setShareFlag -> ${set}`)
   if (!set) return { ok: false, message: "Could not write the share flag into session metadata." }
+  // fresh consent: clear any leave-as-is markers so the engine re-arms
+  // (re-attaching the same pages wherever the secrets still exist)
+  await patchSessionBinding(host.client, rootSessionID, (servers) => {
+    for (const e of Object.values(servers)) {
+      if (e && typeof e === "object") delete (e as Record<string, unknown>).optedOut
+    }
+  })
   const binding = await waitForBinding(host.client, rootSessionID)
   dbgLog(`confirmShare: waitForBinding -> ${binding?.url ? binding.url : "timeout"}`)
   if (!binding?.url) {
+    // a failed create must NOT leave the flag armed: the engine would
+    // publish LATER with no further consent. Disarm now; re-running
+    // /share re-consents.
+    await clearShareFlag(host.client, rootSessionID)
+    const fresh = await readBinding(host.client, rootSessionID)
+    const why = fresh?.lastError ? `\nReason: ${fresh.lastError}` : ""
     return {
       ok: false,
-      message:
-        "Share did not come up (timeout waiting for the URL). Is the worker reachable? Check the server plugin log for [openshare] lines.",
+      message: `Share did not come up (timed out waiting for the URL); the share flag was disarmed.${why}\nCheck the [openshare] stderr lines for details.`,
     }
   }
   await host.clipboard.write(binding.url)

package/src/sidebar.tsx

@@ -9,13 +9,13 @@
 // v1-only: the v2 TUI plugin context has no slot registry. The v2 adapter
 // simply skips this module.
 //
-// SLOT CONTRACT (live-caught 2x): (1) @opentui/core SlotRenderer is called
-// as (ctx, props) — CONTEXT FIRST. (2) The payload MUST be box-rooted:
-// a text root with text children is not hostable through the slot
-// machinery ("TextNodeRenderable only accepts strings…" on embed). Every
-// proven consumer returns box-rooted trees (opencode's own default
-// children, magic-context's sidebar, the host's slot self-test); text
-// nodes stay LEAVES here — string content only.
+// SLOT CONTRACT: (1) @opentui/core SlotRenderer is called as (ctx, props),
+// CONTEXT FIRST. (2) The payload MUST be box-rooted: a text root with text
+// children is not hostable through the slot machinery
+// ("TextNodeRenderable only accepts strings..." on embed). Every proven
+// consumer returns box-rooted trees (opencode's own default children,
+// magic-context's sidebar, the host's slot self-test); text nodes stay
+// LEAVES here, string content only.
 
 import type { JSX } from "@opentui/solid"
 import { bindingsOf, bindingOf, verifyShare } from "./share-flow.js"

package/src/tui.tsx

@@ -42,13 +42,12 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
     hostVersion: 1,
     app: { version: api.app?.version },
     // 1.19.x hands plugins the v2 SDK client — a LAZY PROXY (methods
-    // materialize on property access; spreading it destroys them, which
-    // broke session.update: live-caught "no client.session.update" after
-    // the adapter was added). Wrap with passthrough Proxies instead:
-    //  - path args are translated id -> sessionID (the v2 SDK's URL
-    //    builder left "{sessionID}" literally in the URL for {path:{id}}
-    //    calls — server log: "Expected a string starting with ses, got
-    //    %7BsessionID%7D" — so every session.get/update failed silently),
+    // materialize on property access, and spreading it destroys them, which
+    // breaks session.update). Wrap with passthrough Proxies instead:
+    //  - path args are translated id -> sessionID (the v2 SDK's URL builder
+    //    left "{sessionID}" literally in the URL for {path:{id}} calls, so
+    //    every session.get/update failed silently with
+    //    "Expected a string starting with ses, got %7BsessionID%7D"),
     //  - session.get fills metadata from the state store when the v2
     //    response lacks it,
     //  - everything else reaches the original proxy untouched.
@@ -139,10 +138,10 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
     theme: api.theme,
     ui: {
       toast: (input) => api.ui.toast(input),
-      // dialog.clear() THROWS on an already-empty stack on 1.19.x — and
-      // flows legitimately clear after my components already settled+cleared
-      // (the throw killed confirmShare before it started, live-caught via
-      // the debug log). Idempotent wrapper for every call site.
+      // dialog.clear() THROWS on an already-empty stack on 1.19.x, and flows
+      // legitimately clear after the components already settled and cleared;
+      // the throw kills confirmShare before it starts. Idempotent wrapper for
+      // every call site.
       dialog: new Proxy({} as ShareHostApi["ui"]["dialog"], {
         get: (_t, key: string) => {
           if (key === "clear")
@@ -185,14 +184,13 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
       },
       // CUSTOM interactive dialogs (family MenuDialog pattern: own
       // priority-10000 key layer + mode push + input shield). The host's
-      // ui.DialogX components under plugin dialog.replace render but
-      // receive no keys on opencode 1.19.x (live-caught + pty-reproduced).
-      // These are component functions: flows invoke them inside their own
-      // dialog.replace(() => ...) render thunk (the host renders the thunk
-      // in a proper Solid root, so the hooks inside run with an owner).
-      // DialogX bridge shims (v2 adapter / legacy call sites): route to the
-      // ported promise menus. Nothing on v1 renders these through
-      // dialog.replace anymore — flows use showMenu/showConfirm directly.
+      // ui.DialogX components under plugin dialog.replace render but receive
+      // no keys on opencode 1.19.x. These are component functions: flows
+      // invoke them inside their own dialog.replace(() => ...) render thunk,
+      // and the host renders the thunk in a proper Solid root so the hooks
+      // inside run with an owner. DialogX bridge shims (v2 adapter / legacy
+      // call sites) route to the ported promise menus; no v1 flow renders
+      // through dialog.replace anymore, flows use showMenu/showConfirm.
       DialogSelect: (props) => {
         void showMenuOnce(api, { title: props.title, options: toMenuOptions(props.options), current: props.current, hint: props.placeholder }).then((value) => {
           if (value === undefined) (props as { onCancel?: () => void }).onCancel?.()
@@ -251,11 +249,11 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
       return route.name === "session" ? (route.params?.sessionID as string | undefined) : undefined
     },
     clipboard: {
-      // navigator.clipboard.writeText resolves as a silent no-op in the
-      // TUI runtime (live-caught: the menu copy said "copied" but nothing
-      // landed; the sidebar chip worked because it falls back to OSC52).
-      // Belt-and-braces: try navigator, then ALWAYS emit the OSC52 escape
-      // — harmless when the terminal ignores it, correct when it honors it.
+      // navigator.clipboard.writeText resolves as a silent no-op in the TUI
+      // runtime: the menu reports "copied" and nothing lands (the sidebar chip
+      // works because it falls back to OSC52). Belt-and-braces: try navigator,
+      // then ALWAYS emit the OSC52 escape, which is harmless when the terminal
+      // ignores it and correct when it honors it.
       async write(text) {
         let ok = false
         try {

package/src/ui-prefs.ts

@@ -1,9 +1,9 @@
-// Host-agnostic dialog size preferences (owner decision 2026-10-19: host
-// kv, not the config file — UI settings are per-host and synced by
-// opencode itself). dialog width maps to the host's fixed dialog widths;
-// height is a percent of terminal rows. v1 dialogs apply these directly
-// (dialogs.tsx); the settings dialog edits them through this module so the
-// flows stay host-agnostic.
+// Host-agnostic dialog size preferences, stored in host kv rather than the
+// config file because UI settings are per-host and synced by opencode
+// itself. Dialog width maps to the host's fixed dialog widths; height is a
+// percent of terminal rows. v1 dialogs apply these directly (dialogs.tsx);
+// the settings dialog edits them through this module so the flows stay
+// host-agnostic.
 
 export const UI_WIDTH_KV = "openshare.ui-width"
 export const UI_HEIGHT_PERCENT_KV = "openshare.ui-height-percent"

package/src/v2-server.ts

@@ -229,12 +229,11 @@ export function createV2ServerSetup() {
     // the client adapter and feed them into the engine as the v1 events it
     // understands (session.updated / message.updated / message.part.updated).
     // The engine's keyed queue makes repeated re-syncs idempotent.
-    // NOTE: no content-hash dedupe here — a refresh that runs while the
-    // session is still dormant (pre-flag) would poison the cache without
-    // emitting anything, and the flag-time refresh would then SKIP the
-    // unchanged messages (live-caught in the v2 mock suite: the share's
-    // first assistant content arrived only as the next change). The dedupe
-    // belongs engine-side, where dormancy is known, if it's ever needed.
+    // NOTE: no content-hash dedupe here. A refresh running while the session
+    // is still dormant (pre-flag) would poison the cache without emitting
+    // anything, and the flag-time refresh would then SKIP the unchanged
+    // messages, so the share's first assistant content would only arrive on
+    // the next change. Dedupe belongs engine-side, where dormancy is known.
     const pendingRefresh = new Map<string, ReturnType<typeof setTimeout>>()
     // queued inbox inputs per session: v2 persists the prompt in the inbox
     // (delivery "queue") while the current turn still runs — the message