@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/ci/openshare.js

@@ -19,7 +19,7 @@
 // > code defaults. Keys: servers (multi-server: url -> {token, code,
 // label, active, adminToken}), workerUrl, createToken (legacy pair),
 // shareMode ("all" | "manual"; default = TUI presence), debounceMs,
-// completedDelayMs, modelLabel, ttlDays, openTasksInNewTab,
+// completedDelayMs, modelLabel, ttlDays,
 // authLogin, authPassword, spoolDir, urlFile ("none" = off),
 // announceStderr.
 //
@@ -35,12 +35,13 @@ var DEFAULTS = {
   debounceMs: 1e4,
   completedDelayMs: 5000,
   modelLabel: "$Provider/$Model",
-  ttlDays: 90,
-  openTasksInNewTab: true,
+  ttlHours: 90 * 24,
   authLogin: "",
   authPassword: "",
   spoolDir: "",
   urlFile: "",
+  urlFileFormat: "url",
+  configSet: "",
   announceStderr: true
 };
 var CONFIG_NAME = "openshare.config.json";
@@ -79,6 +80,76 @@ function configPaths(pluginDir, env = process.env) {
 function configHomePath(env = process.env) {
   return join(globalConfigDir(env), CONFIG_NAME);
 }
+function configSourceMap(pluginDir, env = process.env) {
+  const emptyMeansUnset = new Set(["workerUrl", "createToken", "urlFile", "spoolDir"]);
+  const known = new Set([...Object.keys(DEFAULTS), "shareMode", "servers"]);
+  const sources = {};
+  const envKeys = {
+    workerUrl: env.OPENSHARE_WORKER_URL,
+    createToken: env.OPENSHARE_CREATE_TOKEN,
+    debounceMs: env.OPENSHARE_DEBOUNCE_MS,
+    completedDelayMs: env.OPENSHARE_COMPLETED_DELAY_MS,
+    modelLabel: env.OPENSHARE_MODEL_LABEL,
+    ttlHours: env.OPENSHARE_TTL_HOURS,
+    ttlDays: env.OPENSHARE_TTL_DAYS,
+    authLogin: env.OPENSHARE_AUTH_LOGIN,
+    authPassword: env.OPENSHARE_AUTH_PASSWORD,
+    urlFile: env.OPENSHARE_URL_FILE,
+    urlFileFormat: env.OPENSHARE_URL_FILE_FORMAT,
+    configSet: env.OPENSHARE_CONFIG_SET,
+    spoolDir: env.OPENSHARE_SPOOL_DIR,
+    announceStderr: env.OPENSHARE_ANNOUNCE_STDERR,
+    shareMode: env.OPENSHARE_SHARE_MODE
+  };
+  for (const [key, value] of Object.entries(envKeys)) {
+    if (value !== undefined && value !== "")
+      sources[key] = "environment";
+  }
+  if (sources.ttlDays && !sources.ttlHours)
+    sources.ttlHours = sources.ttlDays;
+  delete sources.ttlDays;
+  if (env.OPENSHARE_CONFIG_JSON) {
+    try {
+      const raw = JSON.parse(env.OPENSHARE_CONFIG_JSON);
+      if (raw && typeof raw === "object") {
+        for (const [key, value] of Object.entries(raw)) {
+          if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+            continue;
+          if (sources[key] === "environment")
+            continue;
+          if (key === "servers" || known.has(key))
+            sources[key] = "OPENSHARE_CONFIG_JSON";
+        }
+      }
+    } catch {}
+  }
+  for (const path of configPaths(pluginDir, env)) {
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(path, "utf8"));
+      if (!raw || typeof raw !== "object")
+        continue;
+    } catch {
+      continue;
+    }
+    const label = basename(path) === LOCAL_NAME ? `openshare.local.json (${dirname(path).split(/[\\/]/).pop()})` : `${basename(path)} (${dirname(path).split(/[\\/]/).pop()})`;
+    for (const [key, value] of Object.entries(raw)) {
+      if (key === "servers") {
+        if (sources.servers === undefined && normalizeServers(value))
+          sources.servers = label;
+        continue;
+      }
+      if (sources[key] !== undefined || !known.has(key))
+        continue;
+      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        continue;
+      if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
+        continue;
+      sources[key] = label;
+    }
+  }
+  return sources;
+}
 function num(value, fallback) {
   const parsed = Number(value);
   return Number.isFinite(parsed) ? parsed : fallback;
@@ -105,6 +176,8 @@ function normalizeServers(raw) {
       entry.adminToken = e.adminToken;
     if (e.active === true)
       entry.active = true;
+    if (e.anonymous === true)
+      entry.anonymous = true;
     out[url] = entry;
   }
   return Object.keys(out).length ? out : undefined;
@@ -156,27 +229,57 @@ function loadConfig(pluginDir, options) {
   const cfg = { ...DEFAULTS };
   const emptyMeansUnset = new Set(["workerUrl", "createToken", "urlFile", "spoolDir"]);
   const known = new Set([...Object.keys(DEFAULTS), "shareMode"]);
-  for (const path of [...configPaths(pluginDir)].reverse()) {
-    try {
-      const raw = JSON.parse(readFileSync(path, "utf8"));
-      if (!raw || typeof raw !== "object")
+  const applyObject = (raw) => {
+    if (!raw || typeof raw !== "object")
+      return;
+    for (const [key, value] of Object.entries(raw)) {
+      if (key === "servers") {
+        const servers = normalizeServers(value);
+        if (servers)
+          cfg.servers = mergeServerGroups(cfg.servers, servers);
         continue;
-      for (const [key, value] of Object.entries(raw)) {
-        if (key === "servers") {
-          const servers = normalizeServers(value);
-          if (servers)
-            cfg.servers = mergeServerGroups(cfg.servers, servers);
-          continue;
+      }
+      if (key === "redact") {
+        if (value && typeof value === "object" && Array.isArray(value.patterns)) {
+          const pats = value.patterns.filter((x) => typeof x === "string" && x.length > 0 && x.length < 500).slice(0, 50);
+          cfg.redact = { patterns: pats };
         }
-        if (!known.has(key))
-          continue;
-        if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
-          continue;
-        if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
-          continue;
-        cfg[key] = value;
+        continue;
       }
-    } catch {}
+      if (key === "meta") {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          const clean = {};
+          for (const [mk, mv] of Object.entries(value)) {
+            if (typeof mv === "string" && mv.length <= 500 && mk.length <= 64)
+              clean[mk] = mv;
+          }
+          if (Object.keys(clean).length)
+            cfg.meta = { ...cfg.meta, ...clean };
+        }
+        continue;
+      }
+      if (key === "ttlDays") {
+        const d = Math.floor(Number(value));
+        if (Number.isFinite(d) && d > 0)
+          cfg.ttlHours = d * 24;
+        continue;
+      }
+      if (!known.has(key))
+        continue;
+      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        continue;
+      if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
+        continue;
+      cfg[key] = value;
+    }
+  };
+  for (const path of [...configPaths(pluginDir)].reverse()) {
+    try {
+      applyObject(JSON.parse(readFileSync(path, "utf8")));
+    } catch (e) {
+      if (existsSync(path))
+        console.error(`[openshare] config file ${path} could not be parsed - ignored:`, e?.message ?? e);
+    }
   }
   if (options && typeof options === "object") {
     const serversOpt = normalizeServers(options.servers);
@@ -195,6 +298,13 @@ function loadConfig(pluginDir, options) {
       cfg.shareMode = mode;
   }
   const env = process.env;
+  if (env.OPENSHARE_CONFIG_JSON) {
+    try {
+      applyObject(JSON.parse(env.OPENSHARE_CONFIG_JSON));
+    } catch (e) {
+      console.error("[openshare] OPENSHARE_CONFIG_JSON could not be parsed - ignored:", e?.message ?? e);
+    }
+  }
   if (env.OPENSHARE_WORKER_URL)
     cfg.workerUrl = env.OPENSHARE_WORKER_URL;
   if (env.OPENSHARE_CREATE_TOKEN)
@@ -205,14 +315,20 @@ function loadConfig(pluginDir, options) {
     cfg.completedDelayMs = num(env.OPENSHARE_COMPLETED_DELAY_MS, cfg.completedDelayMs);
   if (env.OPENSHARE_MODEL_LABEL !== undefined)
     cfg.modelLabel = env.OPENSHARE_MODEL_LABEL;
+  if (env.OPENSHARE_TTL_HOURS)
+    cfg.ttlHours = num(env.OPENSHARE_TTL_HOURS, cfg.ttlHours);
   if (env.OPENSHARE_TTL_DAYS)
-    cfg.ttlDays = num(env.OPENSHARE_TTL_DAYS, cfg.ttlDays);
+    cfg.ttlHours = Math.max(1, Math.floor(num(env.OPENSHARE_TTL_DAYS, 90) * 24));
   if (env.OPENSHARE_AUTH_LOGIN !== undefined)
     cfg.authLogin = env.OPENSHARE_AUTH_LOGIN;
   if (env.OPENSHARE_AUTH_PASSWORD !== undefined)
     cfg.authPassword = env.OPENSHARE_AUTH_PASSWORD;
   if (env.OPENSHARE_URL_FILE !== undefined)
     cfg.urlFile = env.OPENSHARE_URL_FILE;
+  if (env.OPENSHARE_URL_FILE_FORMAT === "json" || env.OPENSHARE_URL_FILE_FORMAT === "url")
+    cfg.urlFileFormat = env.OPENSHARE_URL_FILE_FORMAT;
+  if (env.OPENSHARE_CONFIG_SET)
+    cfg.configSet = env.OPENSHARE_CONFIG_SET;
   if (env.OPENSHARE_SPOOL_DIR)
     cfg.spoolDir = env.OPENSHARE_SPOOL_DIR;
   if (env.OPENSHARE_ANNOUNCE_STDERR !== undefined)
@@ -221,6 +337,14 @@ function loadConfig(pluginDir, options) {
     cfg.shareMode = env.OPENSHARE_SHARE_MODE;
   if (cfg.urlFile.trim().toLowerCase() === URL_FILE_NONE)
     cfg.urlFile = URL_FILE_NONE;
+  if (cfg.workerUrl)
+    cfg.workerUrl = cfg.workerUrl.trim().replace(/\/+$/, "");
+  if (cfg.servers) {
+    const fixed = {};
+    for (const [u, e] of Object.entries(cfg.servers))
+      fixed[u.trim().replace(/\/+$/, "")] = e;
+    cfg.servers = fixed;
+  }
   return cfg;
 }
 function spoolDirFor(cfg) {
@@ -345,8 +469,9 @@ function resolveShareMode(cfg, input) {
 
 // src/core.ts
 import { appendFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
 import { createHash } from "node:crypto";
-import { join as join2 } from "node:path";
+import { isAbsolute, join as join2 } from "node:path";
 
 // src/contract.ts
 function messageTombstone(sessionID, messageID) {
@@ -564,6 +689,109 @@ function queueBindingWrite(sid, fn) {
   return run;
 }
 
+// src/redact.ts
+var BUILTINS = [
+  { kind: "aws-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { kind: "gh-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { kind: "gh-token", re: /\bgithub_pat_[A-Za-z0-9_]{22,255}\b/g },
+  { kind: "api-key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: "google-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "bearer", re: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  { kind: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+  { kind: "env-secret", re: /(?<![A-Za-z0-9_])(?:export\s+)?[A-Z0-9_]*(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?)[A-Z0-9_]*\s*=\s*\S+/g },
+  { kind: "conn-string", re: /\b[a-z][a-z0-9+.-]*:\/\/[^:@/\s"']+:[^@/\s"']{4,}@/gi }
+];
+function compile(patterns) {
+  if (!Array.isArray(patterns))
+    return [];
+  const out = [];
+  for (const p of patterns) {
+    if (typeof p !== "string" || !p)
+      continue;
+    try {
+      out.push({ kind: "user", re: new RegExp(p, "g") });
+    } catch {}
+  }
+  return out;
+}
+function tildePath(p, home) {
+  if (!p || !home || p.length <= home.length)
+    return p;
+  const norm = (s) => s.replace(/[\\/]+/g, "/").replace(/\/$/, "");
+  const np = norm(p);
+  const nh = norm(home);
+  if (np === nh)
+    return "~";
+  if (np.startsWith(nh + "/"))
+    return "~" + np.slice(nh.length);
+  return p;
+}
+var PATH_KEYS = new Set(["file", "path", "filePath", "cwd", "directory", "root"]);
+function redactItem(item, opts) {
+  const flat = JSON.stringify(item) ?? "null";
+  const needRedact = opts.enabled && opts.rules.some((r) => {
+    r.re.lastIndex = 0;
+    return r.re.test(flat);
+  });
+  const needPaths = !!opts.home && flat.includes(opts.home);
+  if (!needRedact && !needPaths)
+    return { item, hits: [] };
+  const clone = JSON.parse(flat);
+  const stats = { hits: [], changed: false };
+  walk(clone, opts, stats);
+  return { item: clone, hits: stats.hits };
+}
+function walk(node, opts, stats, key) {
+  if (Array.isArray(node)) {
+    for (let i = 0;i < node.length; i++) {
+      const v = node[i];
+      if (typeof v === "string")
+        node[i] = applyString(v, opts, stats, key);
+      else
+        walk(v, opts, stats, key);
+    }
+    return;
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node)) {
+      if (typeof v === "string")
+        node[k] = applyString(v, opts, stats, k);
+      else
+        walk(v, opts, stats, k);
+    }
+  }
+}
+function applyString(v, opts, stats, key) {
+  let out = v;
+  if (opts.enabled) {
+    for (const r of opts.rules) {
+      r.re.lastIndex = 0;
+      out = out.replace(r.re, (full) => {
+        if (stats.hits.length < 8 && !stats.hits.some((h) => h.kind === r.kind)) {
+          stats.hits.push({ kind: r.kind, sample: full.slice(0, 60) });
+        }
+        stats.changed = true;
+        if (r.kind === "conn-string") {
+          const at = full.lastIndexOf("@");
+          const colon = full.indexOf(":", full.indexOf("://") + 3) + 1;
+          if (at > colon && colon > 0)
+            return full.slice(0, colon) + "[redacted:conn-string]" + full.slice(at);
+        }
+        return `[redacted:${r.kind}]`;
+      });
+    }
+  }
+  if (key && PATH_KEYS.has(key) && opts.home && out.includes(opts.home)) {
+    out = tildePath(out, opts.home);
+    stats.changed = true;
+  }
+  return out;
+}
+function activeRules(userPatterns) {
+  return [...BUILTINS, ...compile(userPatterns)];
+}
+
 // src/core.ts
 var DEFAULT_POLICY = {
   mode: "persistent",
@@ -616,6 +844,19 @@ function redact(info) {
   delete metadata[METADATA_KEY];
   return { ...info, metadata };
 }
+function stripLocalFacts(info) {
+  if (!info || typeof info !== "object")
+    return info;
+  const out = { ...info };
+  let changed = false;
+  for (const k of ["directory", "worktree"]) {
+    if (out[k] !== undefined) {
+      delete out[k];
+      changed = true;
+    }
+  }
+  return changed ? out : info;
+}
 function shareFlag(info) {
   const raw = info?.metadata?.[METADATA_KEY];
   if (!raw || typeof raw !== "object")
@@ -627,8 +868,10 @@ function shareFlag(info) {
   const opts = {};
   if (optsRaw && typeof optsRaw === "object") {
     const o = optsRaw;
-    if (typeof o.ttlDays === "number" && o.ttlDays > 0)
-      opts.ttlDays = o.ttlDays;
+    if (typeof o.ttlHours === "number" && o.ttlHours > 0)
+      opts.ttlHours = Math.floor(o.ttlHours);
+    else if (typeof o.ttlDays === "number" && o.ttlDays > 0)
+      opts.ttlHours = Math.floor(o.ttlDays * 24);
     if (typeof o.authLogin === "string")
       opts.authLogin = o.authLogin;
     if (typeof o.authPassword === "string")
@@ -638,6 +881,9 @@ function shareFlag(info) {
   }
   return { enabled: true, opts: Object.keys(opts).length ? opts : undefined };
 }
+var liveTargets = [];
+var statsProvider = null;
+var redactionLedger = new Map;
 function createEngine(deps) {
   let cfg = loadConfig(deps.pluginDir, deps.options);
   const mode = resolveShareMode(cfg, deps);
@@ -669,8 +915,13 @@ function createEngine(deps) {
   log(`share mode: ${mode} (directory: ${deps.directory ?? "?"} worktree: ${deps.worktree ?? "?"})`);
   const resolveTargets = () => {
     const merged = {};
-    if (cfg.workerUrl)
+    const hasServers = !!cfg.servers && Object.keys(cfg.servers).length > 0;
+    const envWorker = !!process.env.OPENSHARE_WORKER_URL;
+    if (cfg.workerUrl && (!hasServers || envWorker))
       merged[cfg.workerUrl] = { token: cfg.createToken || "", active: true };
+    if (cfg.workerUrl && hasServers && !envWorker && !cfg.servers[cfg.workerUrl]) {
+      log(`legacy workerUrl ${cfg.workerUrl} ignored: a servers group is configured - remove one of the two`);
+    }
     if (cfg.servers)
       for (const [u, e] of Object.entries(cfg.servers))
         merged[u] = { ...merged[u], ...e };
@@ -680,6 +931,7 @@ function createEngine(deps) {
     return chosen.map((url) => ({ url, entry: merged[url] }));
   };
   let targets = resolveTargets();
+  liveTargets = targets.map((t) => t.url);
   const credState = new Map;
   const credOf = (url) => {
     let s = credState.get(url);
@@ -704,40 +956,98 @@ function createEngine(deps) {
   };
   seedCredentials();
   const ENROLL_RETRY_MS = 60000;
+  const setsFetched = new Set;
+  const adoptServerSuggestions = async (url, token) => {
+    if (setsFetched.has(url))
+      return;
+    setsFetched.add(url);
+    try {
+      const r = await fetch(`${url}/api/token/sets`, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(8000)
+      });
+      const body = r.ok ? await r.json().catch(() => null) : null;
+      const sets = body?.sets ?? {};
+      const pick = sets[cfg.configSet ?? ""] ?? Object.values(sets)[0];
+      if (!pick)
+        return;
+      const wantModel = typeof pick.modelLabel === "string" && !pick.modelLabel ? undefined : pick.modelLabel;
+      const wantMode = pick.shareMode === "all" || pick.shareMode === "manual" ? pick.shareMode : undefined;
+      const src = configSourceMap(deps.pluginDir ?? "");
+      const modelUnset = cfg.modelLabel === DEFAULTS.modelLabel && !src.modelLabel;
+      const modeUnset = cfg.shareMode === undefined && !src.shareMode;
+      const adoptModel = wantModel && modelUnset;
+      const adoptMode = wantMode && modeUnset;
+      if (!adoptModel && !adoptMode)
+        return;
+      const home = configHomePath();
+      if (!home)
+        return;
+      let doc = {};
+      try {
+        doc = JSON.parse(readFileSync2(home, "utf8"));
+        if (!doc || typeof doc !== "object")
+          doc = {};
+      } catch {}
+      let dirty = false;
+      if (adoptModel && doc.modelLabel === undefined) {
+        doc.modelLabel = wantModel;
+        dirty = true;
+        log(`${url}: adopted modelLabel from the server config set`);
+      }
+      if (adoptMode && doc.shareMode === undefined) {
+        doc.shareMode = wantMode;
+        dirty = true;
+        log(`${url}: adopted shareMode from the server config set`);
+      }
+      if (dirty)
+        writeFileSync2(home, JSON.stringify(doc, null, 2) + `
+`);
+    } catch {}
+  };
   const ensureCredential = async (url) => {
     const c = credOf(url);
     const target = targets.find((t) => t.url === url);
-    if (c.credential)
+    if (c.credential) {
+      adoptServerSuggestions(url, c.credential);
       return c.credential;
+    }
     if (Date.now() - c.lastEnrollAt < ENROLL_RETRY_MS)
       return "";
     c.lastEnrollAt = Date.now();
-    try {
-      const h = await fetch(`${url}/health`, { signal: AbortSignal.timeout(8000) });
-      const hb = h.ok ? await h.json().catch(() => null) : null;
-      const authMode2 = hb?.auth?.mode;
-      const code = target?.entry.code ?? "";
-      if (authMode2 === "public" || code) {
-        const r = await fetch(`${url}/api/enroll`, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({ code }),
-          signal: AbortSignal.timeout(1e4)
-        });
-        const b = r.ok ? await r.json().catch(() => null) : null;
-        if (b?.ok && typeof b.token === "string") {
-          c.credential = b.token;
+    const code = target?.entry.code ?? "";
+    if (!code) {
+      try {
+        const h = await fetch(`${url}/health`, { signal: AbortSignal.timeout(8000) });
+        const hb = h.ok ? await h.json().catch(() => null) : null;
+        if (hb?.auth?.mode === "public") {
           c.error = "";
-          const savedTo = saveServerToken(url, c.credential);
-          log(`enrolled at ${url} (user ${b.userId} "${b.label}")${savedTo ? " - token saved" : ""}`);
-          return c.credential;
+          return "";
         }
-        c.error = `enroll refused: ${b?.error ?? `HTTP ${r.status}`}`;
-      } else if (authMode2 === "private") {
-        c.error = "private server: add servers.{url}.code (or token) to enroll";
-      } else {
-        c.error = `server health unreachable (HTTP ${h.status})`;
+        c.error = "private server - onboard via /openshare (needs an access code)";
+      } catch (e) {
+        c.error = `server unreachable: ${e?.message || e}`;
       }
+      logError(`no credential for ${url}: ${c.error}`);
+      return "";
+    }
+    try {
+      const r = await fetch(`${url}/api/enroll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code }),
+        signal: AbortSignal.timeout(1e4)
+      });
+      const b = r.ok ? await r.json().catch(() => null) : null;
+      if (b?.ok && typeof b.token === "string") {
+        c.credential = b.token;
+        c.error = "";
+        const savedTo = saveServerToken(url, c.credential);
+        log(`enrolled at ${url} (user ${b.userId} "${b.label}")${savedTo ? " - token saved" : ""}`);
+        adoptServerSuggestions(url, c.credential);
+        return c.credential;
+      }
+      c.error = `enroll refused: ${b?.error ?? `HTTP ${r.status}`}`;
     } catch (e) {
       c.error = `enrollment failed: ${e?.message || e}`;
     }
@@ -853,7 +1163,8 @@ function createEngine(deps) {
     badSignal: false,
     lastSentStatus: null,
     closed: false,
-    prefsSent: false,
+    lastError: null,
+    ttlClamped: null,
     binding: null,
     bindingQueried: false,
     optOuts: new Set,
@@ -872,6 +1183,7 @@ function createEngine(deps) {
       spoolRoot = spoolDirFor(cfg);
       const before = new Set(targets.map((t) => t.url));
       targets = resolveTargets();
+      liveTargets = targets.map((t) => t.url);
       seedCredentials();
       clampToPolicy();
       if (debugEvents) {
@@ -1045,6 +1357,10 @@ function createEngine(deps) {
     const value = { v: 2, servers, enabled: true };
     if (mode === "manual" && st.opts)
       value.opts = st.opts;
+    if (st.lastError)
+      value.lastError = st.lastError;
+    if (st.ttlClamped)
+      value.ttlClamped = st.ttlClamped;
     st.binding = value;
     st.wroteBinding = true;
     await writeMetadata(st, value);
@@ -1225,24 +1541,72 @@ function createEngine(deps) {
     if (cfg.announceStderr)
       log(`live: ${url}`);
     if (mode === "all" && cfg.urlFile !== URL_FILE_NONE) {
-      const file = cfg.urlFile || join2(deps.directory ?? process.cwd(), "openshare.urls.txt");
+      const file = cfg.urlFile ? isAbsolute(cfg.urlFile) ? cfg.urlFile : join2(deps.directory ?? process.cwd(), cfg.urlFile) : join2(deps.directory ?? process.cwd(), "openshare.urls.txt");
       try {
-        appendFileSync(file, url + `
-`);
+        const line = cfg.urlFileFormat === "json" ? JSON.stringify({
+          id: r.shareId,
+          url,
+          status: st.lastSentStatus ?? "waiting",
+          gated: (st.opts?.authLogin ?? cfg.authLogin ?? "") !== ""
+        }) + `
+` : url + `
+`;
+        appendFileSync(file, line);
         if (cfg.announceStderr && (file !== lastUrlFile || !urlFileAnnounced)) {
           urlFileAnnounced = true;
           lastUrlFile = file;
           log(`url file: ${file}`);
         }
-      } catch {}
+      } catch (e) {
+        logError(`url file write failed (${file}):`, e?.message || e);
+      }
     }
   };
+  let halfAuthWarned = false;
   const authFrame = (st) => {
     const login = st.opts?.authLogin ?? cfg.authLogin ?? "";
     const password = st.opts?.authPassword ?? cfg.authPassword ?? "";
+    if (login === "" !== (password === "")) {
+      if (!halfAuthWarned) {
+        halfAuthWarned = true;
+        logError("read auth needs BOTH a login and a password - gate disabled until fixed");
+      }
+      return { authLogin: "", authPassword: "" };
+    }
     return { authLogin: login, authPassword: password };
   };
-  const ttlFor = (st) => st.opts?.ttlDays ?? cfg.ttlDays;
+  const ttlFor = (st) => st.opts?.ttlHours ?? cfg.ttlHours;
+  const metaFor = () => {
+    if (!cfg.meta || typeof cfg.meta !== "object")
+      return;
+    const out = {};
+    let n = 0;
+    for (const [k, v] of Object.entries(cfg.meta)) {
+      if (n >= 20)
+        break;
+      out[k] = v.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (m, name) => process.env[name] ?? m);
+      n++;
+    }
+    return Object.keys(out).length ? out : undefined;
+  };
+  const applyOpts = (st, opts) => {
+    if (!opts)
+      return;
+    const prev = st.opts ? JSON.stringify(st.opts) : "";
+    st.opts = opts;
+    if (prev === JSON.stringify(opts))
+      return;
+    for (const [url, r] of st.remotes) {
+      if (!r.shareId || !r.secret || !r.wsReady)
+        continue;
+      const attach = { id: r.shareId, secret: r.secret, ...authFrame(st) };
+      if (st.opts?.ttlHours)
+        attach.ttlHours = st.opts.ttlHours;
+      const sent = wsSend(r, { op: "init", attach });
+      if (sent)
+        log(`opts re-synced to ${url.slice(0, 24)}${st.opts?.ttlHours ? ` (ttl ${st.opts.ttlHours}h)` : ""}`);
+    }
+  };
   const deleteAbandoned = (r) => {
     const id = r.shareId;
     const secret = r.secret;
@@ -1326,6 +1690,25 @@ function createEngine(deps) {
         r.announced = false;
         queueConnect(st, r);
       }
+      let rearmed = false;
+      for (const [url, e] of Object.entries(servers)) {
+        if (st.optOuts.has(url) || st.remotes.has(url))
+          continue;
+        const ee = e;
+        if (typeof ee.id !== "string" || typeof ee.secret !== "string" || !ee.id)
+          continue;
+        const r = remoteFor(st, url);
+        r.shareId = ee.id;
+        r.secret = ee.secret;
+        r.ackedRev = typeof ee.rev === "number" ? ee.rev : 0;
+        log(`re-share: re-arming ${url.slice(0, 24)} on share ${ee.id}`);
+        queueConnect(st, r);
+        rearmed = true;
+      }
+      if (rearmed) {
+        st.sentHash.clear();
+        chain = chain.then(() => backfill(st)).catch((e) => logError("re-share backfill error", e?.message || e));
+      }
     } catch {}
   };
   const connect = async (st, r) => {
@@ -1417,7 +1800,7 @@ function createEngine(deps) {
       if (r.initWasAttach) {
         wsSend(r, { op: "init", attach: { id: r.shareId, secret: r.secret, ...authFrame(st) } });
       } else {
-        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlDays: ttlFor(st), ...authFrame(st) } });
+        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlHours: ttlFor(st), ...authFrame(st), ...cfg.configSet ? { set: cfg.configSet } : {}, ...metaFor() ? { meta: metaFor() } : {} } });
       }
       r.initTimer = setTimeout(() => {
         if (seq !== r.socketSeq)
@@ -1534,6 +1917,8 @@ function createEngine(deps) {
         const err = String(frame.error ?? "");
         if (/frozen/i.test(err)) {
           r.authBlocked = true;
+          st.lastError = `share frozen by the hoster (owner frozen) - contact the server admin`;
+          scheduleBindingWrite(st);
           logError(`${r.url}: share frozen by the hoster (owner frozen) - edits refused; contact the server admin`);
           try {
             r.ws?.close(4000, "frozen");
@@ -1568,6 +1953,8 @@ function createEngine(deps) {
           return;
         }
         if (/limit|too many|rate/i.test(err)) {
+          st.lastError = `create refused: ${frame.error ?? "rate limited"}`;
+          scheduleBindingWrite(st);
           logError(`${r.url}: create refused:`, frame.error, "- retrying with backoff");
           r.connecting = false;
           try {
@@ -1578,11 +1965,13 @@ function createEngine(deps) {
           return;
         }
         logError(`${r.url}: init refused:`, frame.error, "- creating fresh share");
+        st.lastError = `init refused: ${frame.error ?? "unknown"}`;
+        scheduleBindingWrite(st);
         deleteAbandoned(r);
         r.shareId = null;
         r.secret = null;
         r.ackedRev = 0;
-        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlDays: ttlFor(st), ...authFrame(st) } });
+        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlHours: ttlFor(st), ...authFrame(st), ...cfg.configSet ? { set: cfg.configSet } : {}, ...metaFor() ? { meta: metaFor() } : {} } });
         return;
       }
       if (r.initWasAttach && typeof frame.rev === "number" && frame.rev < r.ackedRev) {
@@ -1591,7 +1980,7 @@ function createEngine(deps) {
         r.shareId = null;
         r.secret = null;
         r.ackedRev = 0;
-        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlDays: ttlFor(st), ...authFrame(st) } });
+        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlHours: ttlFor(st), ...authFrame(st), ...cfg.configSet ? { set: cfg.configSet } : {}, ...metaFor() ? { meta: metaFor() } : {} } });
         return;
       }
       const wasFanoutCreate = !r.initWasAttach && st.everConnected;
@@ -1623,6 +2012,41 @@ function createEngine(deps) {
         applyPolicy(frame.policy, r.url);
       r.intentionalClose = false;
       touch(st);
+      const ackTtl = typeof frame.ttlHours === "number" ? frame.ttlHours : typeof frame.ttlDays === "number" ? frame.ttlDays * 24 : undefined;
+      if (typeof ackTtl === "number") {
+        const wanted = ttlFor(st);
+        const clamp = wanted != null && ackTtl !== wanted ? { requested: wanted, effective: ackTtl } : null;
+        if (JSON.stringify(clamp) !== JSON.stringify(st.ttlClamped)) {
+          st.ttlClamped = clamp;
+          scheduleBindingWrite(st);
+        }
+      }
+      if (st.lastError) {
+        st.lastError = null;
+        scheduleBindingWrite(st);
+      }
+      const wantedGate = (st.opts?.authLogin ?? cfg.authLogin ?? "") !== "" && (st.opts?.authPassword ?? cfg.authPassword ?? "") !== "";
+      if (wantedGate && frame.auth === false && !r.warnedNoGate) {
+        r.warnedNoGate = true;
+        logError(`${r.url}: read auth requested but the page has NO gate - check the server's auth handling`);
+      } else if (frame.auth === true) {
+        r.warnedNoGate = false;
+      }
+      if (credOf(r.url).credential) {
+        const priv = {};
+        const dir = deps.directory ?? "";
+        if (dir)
+          priv.directory = dir;
+        if (deps.worktree)
+          priv.worktree = String(deps.worktree);
+        try {
+          priv.home = homedir();
+        } catch {}
+        if (Object.keys(priv).length) {
+          const seq = ++nextSeq;
+          wsSend(r, { op: "sync", items: [{ type: "pmeta", sessionID: st.sid, data: priv }], status: undefined, seq });
+        }
+      }
       announceUrl(st, r);
       if (!st.wroteBinding) {
         chain = chain.then(() => writeBinding(st)).catch(() => {});
@@ -1833,6 +2257,15 @@ function createEngine(deps) {
       }).catch((e) => logError("flush error", e?.message || e));
     }, wait);
   };
+  const homeDir = (() => {
+    try {
+      return homedir();
+    } catch {
+      return "";
+    }
+  })();
+  const userPatterns = cfg.redact?.patterns;
+  const redactionRules = activeRules(userPatterns);
   const enqueue = (st, entry) => {
     if (!st || !entry)
       return;
@@ -1849,6 +2282,22 @@ function createEngine(deps) {
     }
     if (h)
       st.sentHash.set(entry.key, h);
+    {
+      const gate = authFrame(st);
+      const gated = gate.authLogin !== "" && gate.authPassword !== "";
+      const pass = redactItem(entry.item, { rules: redactionRules, home: homeDir, enabled: !gated });
+      if (pass.item !== entry.item)
+        entry = { ...entry, item: pass.item };
+      if (pass.hits.length) {
+        const led = redactionLedger.get(st.sid) ?? { count: 0, samples: [] };
+        led.count += pass.hits.length;
+        for (const hit of pass.hits) {
+          if (led.samples.length < 5 && !led.samples.some((x) => x.kind === hit.kind))
+            led.samples.push(hit);
+        }
+        redactionLedger.set(st.sid, led);
+      }
+    }
     st.queue.set(entry.key, entry.item);
     indexMessage(entry);
     if (debugEvents)
@@ -1857,6 +2306,24 @@ function createEngine(deps) {
     ensureConnected(st);
     scheduleFlush(st);
   };
+  statsProvider = (sid) => {
+    const st = sessions.get(sid);
+    let messages = 0;
+    let toolCalls = 0;
+    if (st) {
+      for (const [, merged] of st.merged) {
+        messages++;
+        const content = merged.content;
+        if (Array.isArray(content))
+          toolCalls += content.filter((c) => !!c && c.type === "tool").length;
+      }
+      for (const it of st.queue.values()) {
+        if (it?.type === "message")
+          messages++;
+      }
+    }
+    return { messages, toolCalls };
+  };
   const msgIndex = new Map;
   const tombstoned = new Set;
   const indexMessage = (entry) => {
@@ -2279,7 +2746,7 @@ function createEngine(deps) {
   const backfillSession = async (st, client, sid, info) => {
     const sessionInfoValue = info ?? await sessionInfo(client, sid);
     if (sessionInfoValue)
-      enqueue(st, itemFor("session", redact(sessionInfoValue), sid));
+      enqueue(st, itemFor("session", stripLocalFacts(redact(sessionInfoValue)), sid));
     let modelSeen = false;
     const consume = (messages) => {
       for (const message of messages) {
@@ -2319,7 +2786,7 @@ function createEngine(deps) {
     if (messages.length === 0 && !info) {
       const fetched = await sessionInfo(client, st.sid);
       if (fetched)
-        enqueue(st, itemFor("session", redact(fetched), st.sid));
+        enqueue(st, itemFor("session", stripLocalFacts(redact(fetched)), st.sid));
     }
     if (typeof client.session.list === "function") {
       try {
@@ -2396,12 +2863,8 @@ function createEngine(deps) {
       if (parent) {
         const st = sessions.get(parent);
         if (st?.activated && !st.closed) {
-          if (!st.prefsSent) {
-            st.prefsSent = true;
-            enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-          }
           if (info)
-            enqueue(st, itemFor("session", redact(info), sid));
+            enqueue(st, itemFor("session", stripLocalFacts(redact(info)), sid));
         }
         return;
       }
@@ -2410,23 +2873,14 @@ function createEngine(deps) {
       if (flag.enabled) {
         if (st?.activated && !st.closed) {
           if (flag.opts)
-            st.opts = flag.opts;
-          if (!st.prefsSent) {
-            st.prefsSent = true;
-            enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-          }
+            applyOpts(st, flag.opts);
           if (info)
-            enqueue(st, itemFor("session", redact(info), sid));
+            enqueue(st, itemFor("session", stripLocalFacts(redact(info)), sid));
           if (t === "session.updated")
             chain = chain.then(() => refreshOptOuts(st)).catch(() => {});
           return;
         }
         activate(sid, flag.opts, info);
-        const fresh = sessions.get(sid);
-        if (fresh && !fresh.prefsSent) {
-          fresh.prefsSent = true;
-          enqueue(fresh, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-        }
         return;
       }
       if (st?.activated && !st.closed && t === "session.updated") {
@@ -2472,12 +2926,8 @@ function createEngine(deps) {
     }
     if (!st)
       return;
-    if (!st.prefsSent) {
-      st.prefsSent = true;
-      enqueue(st, itemFor("prefs", { openTasksInNewTab: cfg.openTasksInNewTab !== false }, sid));
-    }
     if (info)
-      enqueue(st, itemFor("session", redact(info), sid));
+      enqueue(st, itemFor("session", stripLocalFacts(redact(info)), sid));
     if (t === "session.updated" && st.activated && !st.closed) {
       chain = chain.then(() => refreshOptOuts(st)).catch(() => {});
     }
@@ -2685,6 +3135,21 @@ function createEngine(deps) {
           st.metaTimer = null;
           await writeBinding(st).catch(() => {});
         }
+        const barrierStart = Date.now();
+        while (Date.now() - barrierStart < 5000) {
+          let pendingAnnounce = false;
+          for (const st of sessions.values()) {
+            for (const r of st.remotes.values()) {
+              if (r.authBlocked || r.collided)
+                continue;
+              if (r.shareId && !r.announced || !r.shareId && (r.ws || r.connecting))
+                pendingAnnounce = true;
+            }
+          }
+          if (!pendingAnnounce)
+            break;
+          await new Promise((res) => setTimeout(res, 100));
+        }
         for (const st of sessions.values()) {
           for (const r of st.remotes.values()) {
             try {