@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/dist/settings.js

@@ -5,7 +5,7 @@
 //
 // Sections: Connection, Sharing, Read auth, Advanced, This session.
 import { configSourceMap, moduleDir, writeCandidates } from "./config.js";
-import { adminClient, adminTokenFor, currentConfig, deleteServerEntry, disconnectAtServer, enrollAtServer, hostOf, isConfigured, normServerUrl, probeAuthMode, probeWorker, patchSessionBinding, readBinding, readBindings, resolveRoot, rotateAtServer, runUnshareFlow, saveConfig, saveServerEntry, serverEntries, setShareFlag, shareWithConsent, workerDeleteShare, } from "./share-flow.js";
+import { adminClient, adminTokenFor, currentConfig, deleteServerEntry, disconnectAtServer, enrollAtServer, fmtHours, parseTtlHours, hostOf, isConfigured, normServerUrl, probeAuthMode, probeWorker, patchSessionBinding, patchShareOpts, readBinding, readBindings, resolveRoot, rotateAtServer, runUnshareFlow, saveConfig, saveServerEntry, meClient, serverEntries, setShareOpts, shareWithConsent, workerDeleteShare, } from "./share-flow.js";
 import { DIALOG_WIDTH_COLUMNS, kvHeightPercentOf, kvWidthOf, nextDialogWidth, UI_HEIGHT_PERCENT_KV, UI_WIDTH_KV, clampHeightPercent } from "./ui-prefs.js";
 /** description suffix: `[from <source>]` when a key is overridden by a
  * file/env higher in the chain than the write target. */
@@ -58,11 +58,11 @@ const LABELS = {
     },
     shareMode: {
         label: "Share mode",
-        help: '"all" shares every session; "manual" needs /share. Default: TUI presence.',
+        help: '"all" shares every session; "manual" needs /share. Default: TUI presence. Takes effect after opencode restarts.',
         kind: "text",
         options: ["auto", "all", "manual"],
         section: "Sharing",
-        info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared — share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides — installing the TUI part means manual, server-only means all.',
+        info: 'all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared - share those explicitly. manual: sessions stay private until you run /share.\n\nDefault (empty): TUI presence decides - installing the TUI part means manual, server-only means all.\n\nNOTE: the mode is resolved once at plugin load. Changing it here saves immediately but only takes effect after opencode restarts - until then new sessions keep following the OLD mode.',
         def: "auto (TUI presence)",
     },
     debounceMs: {
@@ -89,22 +89,13 @@ const LABELS = {
         info: 'How the model name appears on the share page. "$Provider/$Model" renders e.g. "closedrouter/zai/glm-5.3". Any literal text is used as-is; empty string hides the model line entirely.',
         def: '"$Provider/$Model"',
     },
-    ttlDays: {
-        label: "TTL (days)",
-        help: "Share lifetime; the worker caps it at its MAX_TTL_DAYS.",
+    ttlHours: {
+        label: "TTL (hours)",
+        help: "Share lifetime in hours (2d writes 48); capped server-side.",
         kind: "number",
         section: "Sharing",
-        info: "How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.\n\nA per-session override lives in the This-session section; it is sent at create/attach time.",
-        def: "worker cap (90 on the reference deployment)",
-    },
-    openTasksInNewTab: {
-        label: "Open tasks in new tab",
-        help: "Viewer: task rows open subagent pages in a new tab.",
-        kind: "text",
-        options: ["true", "false"],
-        section: "Sharing",
-        info: "Viewer behavior only: clicking a task (subagent) row opens its sub-page in a new browser tab instead of navigating. true/false.",
-        def: "true",
+        info: "How long pages live before the server's sweeper deletes them, in HOURS. Capped server-side: the deployment's MAX_TTL_HOURS (legacy MAX_TTL_DAYS converted) and the token's limit both apply; the floor is one hour.\n\nA per-session override lives in the This-session section; it is sent at create/attach time. The session prompt takes 6h / 2d style input.",
+        def: "worker cap (2160h = 90d on the reference deployment)",
     },
     authLogin: {
         label: "Read auth: login",
@@ -165,10 +156,8 @@ function helpForKey(key, cfg, sources) {
 function displayValue(key, cfg) {
     if (key === "createToken" || key === "authPassword")
         return mask(String(cfg[key] ?? ""));
-    if (key === "openTasksInNewTab")
-        return String(cfg.openTasksInNewTab !== false);
     if (key === "announceStderr")
-        return String(cfg.announceStderr !== false);
+        return cfg.announceStderr !== false ? "on" : "off";
     const value = cfg[key];
     return value === undefined || value === "" ? "(not set)" : String(value);
 }
@@ -176,8 +165,8 @@ async function editKey(host, cfg, key) {
     const meta = LABELS[key];
     if (!meta)
         return undefined;
-    // selection-backed settings (owner: "setting share mode i need to enter it
-    // manually? No selection?") — fixed vocabularies become menus
+    // selection-backed settings: fixed vocabularies become menus instead of
+    // asking for a typed value
     if (meta.options) {
         const current = String(cfg[key] ?? "");
         const picked = await showSelect(host.ui, {
@@ -194,7 +183,7 @@ async function editKey(host, cfg, key) {
         const next = { ...cfg };
         if (key === "shareMode")
             next[key] = picked === "auto" ? undefined : picked;
-        else if (key === "openTasksInNewTab" || key === "announceStderr")
+        else if (key === "announceStderr")
             next[key] = picked === "true";
         else
             next[key] = picked;
@@ -225,10 +214,14 @@ async function editKey(host, cfg, key) {
     }
     return next;
 }
-/** Connect (add + enroll) a server — the /share first-run flow and the
+/** Connect (add + enroll) a server - the /share first-run flow and the
  * settings "Connect to a server" row share it. Prompts the URL, probes
- * the auth mode, prompts a code for private servers, enrolls, persists
- * the token and makes it the active server. */
+ * the auth mode, then ASKS ONCE: onboard to an account, or stay anonymous
+ * (public servers only; anonymous shares sit under the server's global
+ * caps). Onboarding detects whether a code is needed and only then prompts
+ * for one (a code already in config is used without asking). The outcome is
+ * remembered per server: a token means onboarded, an anonymous flag means
+ * declined. */
 export async function connectServerFlow(host) {
     const raw = await showPrompt(host.ui, { title: "Share server URL", placeholder: "https://your-openshare-host" });
     if (raw === undefined || raw === "")
@@ -236,33 +229,84 @@ export async function connectServerFlow(host) {
     const url = normServerUrl(raw);
     if (!/^https?:\/\//.test(url))
         return { ok: false, message: "URL must start with http:// or https://" };
-    host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}…` });
+    host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}:` });
     const probe = await probeAuthMode(url);
     if (!probe.ok)
         return { ok: false, message: `${url}: ${probe.detail}` };
-    let code = "";
-    if (probe.mode === "private") {
-        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" });
+    const existing = serverEntries().find((sv) => sv.url === url)?.entry ?? {};
+    const deactivateOthers = () => {
+        for (const other of serverEntries()) {
+            if (other.url !== url)
+                saveServerEntry(other.url, { active: undefined });
+        }
+    };
+    if (probe.mode === "public") {
+        // the ask: an account is a real thing (own shares, own limits,
+        // revocable credentials) - but anonymous sharing works too
+        const picked = await showSelect(host.ui, {
+            title: `${url} - account?`,
+            options: [
+                {
+                    value: "onboard",
+                    title: "Onboard (get an account)",
+                    description: "your own user, tokens and share limits; survives the server's anonymous caps",
+                    help: "An account gives you a revocable identity with your own share registry and limits. Depending on the server you may need a one-time access code from the hoster - you'll be asked only if it's required.",
+                },
+                {
+                    value: "anon",
+                    title: "Stay anonymous",
+                    description: "share without an account; counts against the server-wide anonymous limits",
+                    help: "No identity, no token to manage. Shares are ownerless: whoever holds the share's secret controls them, and the server may throttle anonymous creates globally. You can onboard later from Servers -> the server -> Enroll now.",
+                },
+            ],
+        });
+        if (picked === "anon") {
+            saveServerEntry(url, { ...(existing.token ? {} : { anonymous: true }), label: existing.label, active: true });
+            return { ok: true, message: `Connected to ${url} anonymously - sharing works, no account.`, url };
+        }
+        if (picked === undefined || picked === null)
+            return { ok: false, message: "Cancelled." };
+        // onboard: try without a code (codeless servers), fall through to
+        // the code prompt exactly when the server demands one
+        let code = existing.code ?? "";
+        if (!code) {
+            const free = await enrollAtServer(url, "");
+            if (free.ok) {
+                deactivateOthers();
+                saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined, active: true });
+                return { ok: true, message: `Connected to ${url} as "${free.label}" - sharing goes there now.`, url };
+            }
+            const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
+            if (typed === undefined)
+                return { ok: false, message: "Cancelled - this server needs a code to onboard." };
+            code = typed.trim();
+        }
+        const res = await enrollAtServer(url, code);
+        if (!res.ok)
+            return { ok: false, message: `Enrollment refused: ${res.error}` };
+        deactivateOthers();
+        saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, anonymous: undefined, active: true });
+        return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url };
+    }
+    // private server: a code is required, full stop
+    let code = existing.code ?? "";
+    if (!code) {
+        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
         if (typed === undefined)
-            return { ok: false, message: "Cancelled — private servers need a code." };
+            return { ok: false, message: "Cancelled - private servers need a code." };
         code = typed.trim();
     }
     const res = await enrollAtServer(url, code);
     if (!res.ok)
         return { ok: false, message: `Enrollment refused: ${res.error}` };
-    // single active server: deactivate the others in the settings home,
-    // then persist the new membership as active
-    for (const other of serverEntries()) {
-        if (other.url !== url)
-            saveServerEntry(other.url, { active: undefined });
-    }
+    deactivateOthers();
     saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, active: true });
-    return { ok: true, message: `Connected to ${url} as "${res.label}" — sharing goes there now.`, url };
+    return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url };
 }
 /** Per-server submenu: identity status + membership actions. Root-token
- * holders get "Get a user token" (admin mints their own user identity —
- * root stays as adminToken; being admin and being a user are NOT mutually
- * exclusive, live-caught). */
+ * holders get "Get a user token" (the admin mints their own user identity;
+ * root stays as adminToken, since being admin and being a user are not
+ * mutually exclusive). */
 async function serverMenu(host, url) {
     while (true) {
         const entries = serverEntries();
@@ -276,7 +320,9 @@ async function serverMenu(host, url) {
                 ? `token ${mask(mine.entry.token)}`
                 : mine.entry.code
                     ? "no token (code saved, enrolls on demand)"
-                    : "no token (public server, enrolls on demand)";
+                    : mine.entry.anonymous
+                        ? "anonymous (declined onboarding)"
+                        : "no token (public server, shares anonymously)";
         const options = [
             { title: url, value: "info", description: `${mine.entry.label ?? "(no label)"} · ${cred}${mine.active ? " · ACTIVE" : ""}`, disabled: true },
         ];
@@ -294,6 +340,8 @@ async function serverMenu(host, url) {
             options.push({ title: "Enroll now", value: "enroll", description: holdsRoot ? "join as a user via code/public enrollment" : "get a user token immediately" });
         if (mine.entry.token && !holdsRoot)
             options.push({ title: "Rotate token", value: "rotate", description: "new token, old one revoked" });
+        if (mine.entry.token && !holdsRoot)
+            options.push({ title: "Your account", value: "account", description: "limits, token expiry, your shares" });
         if (mine.entry.token && !holdsRoot)
             options.push({ title: "Disconnect", value: "disconnect", description: "revoke the token server-side and forget it", danger: true });
         options.push({
@@ -309,12 +357,16 @@ async function serverMenu(host, url) {
         if (choice === undefined || choice === "__back")
             return;
         if (choice === "active") {
-            for (const other of entries) {
-                if (other.url !== url)
-                    saveServerEntry(other.url, { active: undefined });
-            }
+            // make-primary WITHOUT collapsing fan-out: other explicit actives
+            // stay active (the engine targets every active entry); silently
+            // deactivating them destroyed hand-built multi-server setups
             saveServerEntry(url, { active: true });
-            host.ui.toast({ variant: "success", title: "OpenShare", message: `${url} is now the active server.` });
+            const stillActive = serverEntries().filter((s) => s.active);
+            host.ui.toast({
+                variant: "success",
+                title: "OpenShare",
+                message: stillActive.length > 1 ? `${url} is primary - ${stillActive.length} servers stay ACTIVE (fan-out): new sessions mirror to all of them.` : `${url} is now the active server.`,
+            });
             return;
         }
         if (choice === "adopt") {
@@ -349,8 +401,20 @@ async function serverMenu(host, url) {
                 continue;
             }
             let code = mine.entry.code ?? "";
-            if (probe.mode === "private" && !code) {
-                const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" });
+            if (!code) {
+                // codeless first: only prompt when the server actually demands
+                // a code (public + codeless-on boards silently, like connect)
+                const free = await enrollAtServer(url, "");
+                if (free.ok) {
+                    saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined });
+                    host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${free.label}".` });
+                    continue;
+                }
+                if (!/code required/i.test(free.error ?? "")) {
+                    await showInfo(host.ui, { title: "Enrollment refused", message: free.error ?? "unknown error" });
+                    continue;
+                }
+                const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
                 if (typed === undefined)
                     continue;
                 code = typed.trim();
@@ -359,7 +423,7 @@ async function serverMenu(host, url) {
             }
             const res = await enrollAtServer(url, code);
             if (res.ok) {
-                saveServerEntry(url, { token: res.token, label: res.label });
+                saveServerEntry(url, { token: res.token, label: res.label, anonymous: undefined });
                 host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${res.label}".` });
             }
             else {
@@ -367,6 +431,32 @@ async function serverMenu(host, url) {
             }
             continue;
         }
+        if (choice === "account") {
+            const me = meClient(url, mine.entry.token ?? "");
+            const [meRes, sharesRes] = await Promise.all([me.me(), me.myShares()]);
+            if (!meRes.ok) {
+                await showInfo(host.ui, { title: "Account", message: `Could not read your account: ${meRes.error ?? "error"}.\nIf the token was revoked server-side, use Enroll now instead.` });
+                continue;
+            }
+            const d = meRes.data;
+            const lim = d.token?.limits ?? {};
+            const fmt = (v) => (v ? String(v) : "unlimited");
+            const lines = [
+                `User: ${d.label} (${d.userId})`,
+                `Token: ${d.token?.label ?? "?"} - expires ${d.token?.expiresAt ? new Date(d.token.expiresAt).toISOString().slice(0, 10) : "never"}`,
+                `Limits: live shares ${fmt(lim.maxLiveShares)} - max TTL ${fmt(lim.maxTtlDays)}d - daily creates ${fmt(lim.dailyCreates)}`,
+            ];
+            if (sharesRes.ok) {
+                const shares = sharesRes.data?.shares ?? [];
+                lines.push(`Shares: ${shares.length} (${shares.filter((s) => s.status === "live").length} live)`);
+                for (const s of shares.slice(0, 10))
+                    lines.push(`  ${s.id} - ${s.status} - ${new Date(s.createdAt).toISOString().slice(0, 10)}`);
+                if (shares.length > 10)
+                    lines.push(`  ...and ${shares.length - 10} more`);
+            }
+            await showInfo(host.ui, { title: "Your account", message: lines.join("\n") });
+            continue;
+        }
         if (choice === "rotate") {
             const res = await rotateAtServer(url, mine.entry.token ?? "");
             if (res.ok && res.token) {
@@ -379,7 +469,12 @@ async function serverMenu(host, url) {
             continue;
         }
         if (choice === "disconnect") {
-            const sure = await showConfirm(host.ui, { title: "Disconnect", message: `Revoke the token at ${url} and forget it?\nYour shares stay (read-only for you until TTL).`, confirmLabel: "Disconnect", danger: true });
+            const sure = await showConfirm(host.ui, {
+                title: "Disconnect",
+                message: `Revoke the token at ${url} and forget it?\nRevoking your last token freezes control of ALL your shares there (even with the share secrets) - pages stay readable until their TTL; only the server admin can restore control.`,
+                confirmLabel: "Disconnect",
+                danger: true,
+            });
             if (!sure)
                 continue;
             const res = await disconnectAtServer(url, mine.entry.token ?? "");
@@ -543,9 +638,9 @@ async function withBusy(host, title, work) {
     catch { }
     doneBusy?.();
 }
-/** Server info, the readable version (live-caught: the raw JSON policy line
- * escaped the dialog border): formatted policy lines, auth explained in
- * words, YOUR standing on this server, and follow-up actions. */
+/** Server info, the readable version (the raw JSON policy line escapes
+ * the dialog border): formatted policy lines, auth explained in words,
+ * YOUR standing on this server, and follow-up actions. */
 async function serverInfoScreen(host, url, client) {
     const h = await client.health();
     if (!h.ok) {
@@ -809,16 +904,15 @@ async function adminSharesMenu(host, client, url, shares, users) {
     }
 }
 /** The settings dialog: a compact ROOT of group entries (with live
- * summaries) opening focused submenus. Two-level by design — one flat
- * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
- * Save semantics unchanged: root Exit saves when dirty; submenu Back
- * just returns. */
-export async function settingsDialog(host, startAtSession) {
+ * summaries) opening focused submenus. Two-level by design: one flat ~25-row
+ * dump is unreadable. Save semantics unchanged: root Exit saves when dirty;
+ * submenu Back just returns. */
+export async function settingsDialog(host, startAtSession, startGroup) {
     let cfg = currentConfig();
     let dirty = false;
-    // Write target (owner rule): global settings home by default; any other
-    // existing file in the read chain may be chosen explicitly. The TUI
-    // never creates deploy-time override files.
+    // Write target: global settings home by default; any other existing
+    // file in the read chain may be chosen explicitly. The TUI never
+    // creates deploy-time override files.
     const candidates = writeCandidates(moduleDir());
     let writeTarget = candidates[0];
     const sources = configSourceMap(moduleDir());
@@ -967,17 +1061,25 @@ export async function settingsDialog(host, startAtSession) {
             }
         }
         const binding = bindings[0];
+        if (binding?.lastError || binding?.ttlClamped) {
+            const bits = [];
+            if (binding?.ttlClamped)
+                bits.push(`TTL clamped ${binding.ttlClamped.requested}d -> ${binding.ttlClamped.effective}d by server/token policy`);
+            if (binding?.lastError)
+                bits.push(`last share error: ${binding.lastError}`);
+            rows.push({ title: "Share status notes", value: "__notes", description: bits[0].slice(0, 60), disabled: true, help: `Engine-recorded notes for this session's share(s):\n\n${bits.join("\n")}\n\nThe clamp note appears when the server or your token's policy reduced a requested TTL. The error note is the engine's last create/attach refusal (quota, freeze, rate limit) - it clears on the next successful sync.` });
+        }
         rows.push({
             title: "Session TTL override (days)",
             value: "session:ttl",
-            description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-            help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. Applied at the next create/attach.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
+            description: binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(worker default)",
+            help: `Per-session share lifetime in HOURS (prompt accepts 6h / 2d / 48). Overrides the config TTL for THIS session's pages; still capped server-side. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(none — config default)"}`,
         });
         rows.push({
             title: "Session read auth",
             value: "session:auth",
             description: binding?.opts?.authLogin ? `${binding.opts.authLogin} / ****` : "(config default)",
-            help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth. Applied at the next create/attach; removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
+            help: `Login gate for THIS session's page only — viewers must log in (7-day cookie, lockout). Overrides the config read auth; a login and password are both required (or neither). On a live share it applies immediately; otherwise when you share. Removing the login removes the gate.\n\nCurrent: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none — config default applies)"}`,
         });
         return rows;
     };
@@ -1161,11 +1263,11 @@ export async function settingsDialog(host, startAtSession) {
                 });
                 if (!pick || pick === "__cancel")
                     return;
-                for (const s of serverEntries())
-                    if (s.url !== pick)
-                        saveServerEntry(s.url, { active: undefined });
+                // fan-out add: activate the picked server WITHOUT deactivating the
+                // current ones - this session (and new sessions) mirror everywhere
                 saveServerEntry(pick, { active: true });
-                host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated — this session mirrors there within seconds.` });
+                const nActive = serverEntries().filter((s) => s.active).length;
+                host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated (${nActive} active) - this session mirrors there within seconds.` });
                 return;
             }
             if (choice === "session:unshare") {
@@ -1180,48 +1282,79 @@ export async function settingsDialog(host, startAtSession) {
                 if (how === undefined || how === "__cancel")
                     return;
                 if (how === "leave") {
-                    const all = await readBindings(host.client, root);
+                    const allB = await readBindings(host.client, root);
                     const okPatch = await patchSessionBinding(host.client, root, (servers) => {
-                        for (const b of all) {
+                        for (const b of allB) {
                             if (!b.server)
                                 continue;
-                            delete servers[b.server];
-                            servers[b.server] = { optedOut: true };
+                            // keep id/secret on the opt-out marker: the snapshot stays
+                            // deletable later, and re-sharing reuses the binding instead
+                            // of stalling on a secret-less marker that can never unshare
+                            // or re-share again.
+                            servers[b.server] = { ...servers[b.server], id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true };
                         }
                     });
-                    host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs." : "Could not update the binding." });
+                    host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is — snapshots until their TTLs (delete stays available here)." : "Could not update the binding." });
                     return;
                 }
+                const sureAll = await showConfirm(host.ui, {
+                    title: "Delete every page?",
+                    message: `Permanently delete ${live.length} share page(s) and stop sharing?\nEvery link stops working for everyone. This cannot be undone.`,
+                    confirmLabel: "Delete every page",
+                    danger: true,
+                });
+                if (!sureAll)
+                    return;
                 const result = await runUnshareFlow(host, startAtSession);
                 host.ui.toast({ variant: result.ok ? "success" : "error", title: "OpenShare", message: result.message });
                 return;
             }
             if (choice === "session:ttl") {
-                const raw = await showPrompt(host.ui, { title: "Session TTL (days)", placeholder: "days", value: current?.opts?.ttlDays !== undefined ? String(current.opts.ttlDays) : "" });
+                const raw = await showPrompt(host.ui, { title: "Session TTL", placeholder: "hours: 6h, 2d or 48", value: current?.opts?.ttlHours !== undefined ? fmtHours(current.opts.ttlHours) : "" });
                 if (raw === undefined)
                     return;
                 const opts = { ...(current?.opts ?? {}) };
                 if (raw === "")
-                    delete opts.ttlDays;
+                    delete opts.ttlHours;
                 else {
-                    const days = Number(raw);
-                    if (!Number.isFinite(days) || days <= 0) {
-                        host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be a positive number of days." });
+                    const hours = parseTtlHours(raw);
+                    if (hours === undefined) {
+                        host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be 6h / 2d style or a positive number of hours." });
                         return;
                     }
-                    opts.ttlDays = Math.floor(days);
+                    opts.ttlHours = hours;
                 }
-                await setShareFlag(host.client, root, opts);
-                host.ui.toast({ variant: "success", title: "OpenShare", message: opts.ttlDays !== undefined ? `Session TTL: ${opts.ttlDays}d (applies at the next attach/create)` : "Session TTL override cleared" });
+                await setShareOpts(host.client, root, opts);
+                const liveNow = live.length > 0;
+                if (liveNow) {
+                    // REST push (#13): immediate on every server, socket or not
+                    const results = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, opts.ttlHours !== undefined ? { ttlHours: opts.ttlHours } : {}, b.secret) : Promise.resolve({ ok: false })));
+                    const failed = results.filter((r) => !r.ok).length;
+                    if (failed)
+                        host.ui.toast({ variant: "error", title: "OpenShare", message: `TTL applied on ${results.length - failed}/${results.length} server(s) - the rest sync on next connect.` });
+                }
+                host.ui.toast({
+                    variant: "success",
+                    title: "OpenShare",
+                    message: liveNow
+                        ? `Session TTL: ${opts.ttlHours !== undefined ? `${fmtHours(opts.ttlHours)} - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
+                        : `Session TTL: ${opts.ttlHours !== undefined ? fmtHours(opts.ttlHours) : "(default)"} - saved, applies when you share.`,
+                });
                 return;
             }
             if (choice === "session:auth") {
-                const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = use config default", value: current?.opts?.authLogin ?? "" });
+                const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = no read auth", value: current?.opts?.authLogin ?? "" });
                 if (login === undefined)
                     return;
-                const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: "empty = no password" });
+                const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: login === "" ? "(unused)" : "password (required with a login)" });
                 if (password === undefined)
                     return;
+                // both-or-none: the server builds a gate only from a full pair, and
+                // rendering half a pair would show protection that does not exist
+                if ((login === "") !== (password === "")) {
+                    host.ui.toast({ variant: "error", title: "OpenShare", message: "Read auth needs both a login and a password - or neither (no gate)." });
+                    return;
+                }
                 const opts = { ...(current?.opts ?? {}) };
                 if (login === "") {
                     delete opts.authLogin;
@@ -1229,13 +1362,18 @@ export async function settingsDialog(host, startAtSession) {
                 }
                 else {
                     opts.authLogin = login;
-                    if (password !== "")
-                        opts.authPassword = password;
-                    else
-                        delete opts.authPassword;
+                    opts.authPassword = password;
+                }
+                await setShareOpts(host.client, root, opts);
+                const liveNow2 = live.length > 0;
+                if (liveNow2) {
+                    const pair = login === "" ? { authLogin: "", authPassword: "" } : { authLogin: login, authPassword: password };
+                    const results2 = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, pair, b.secret) : Promise.resolve({ ok: false })));
+                    const failed2 = results2.filter((r) => !r.ok).length;
+                    if (failed2)
+                        host.ui.toast({ variant: "error", title: "OpenShare", message: `Read auth applied on ${results2.length - failed2}/${results2.length} server(s) - the rest sync on next connect.` });
                 }
-                await setShareFlag(host.client, root, opts);
-                host.ui.toast({ variant: "success", title: "OpenShare", message: "Session read auth saved (applies at the next attach/create)." });
+                host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` });
                 return;
             }
         }
@@ -1254,6 +1392,10 @@ export async function settingsDialog(host, startAtSession) {
         }
     };
     // ---- root: compact group list with live summaries --------------------------
+    // /share on a shared session lands HERE, straight in the session menu -
+    // one selection sooner (Back still reaches the full root)
+    if (startAtSession && startGroup === "session")
+        await groupMenu("session");
     const seconds = (ms, fallback) => `${Math.round((ms ?? fallback) / 100) / 10}s`;
     while (true) {
         const servers = serverEntries(cfg);
@@ -1280,7 +1422,7 @@ export async function settingsDialog(host, startAtSession) {
         });
         groups.push({
             id: "sharing",
-            summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${cfg.ttlDays ?? "server cap"}`,
+            summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${fmtHours(cfg.ttlHours ?? 2160)}`,
             help: `What and how sessions stream: share mode (all/manual), sync cadence, the completed-delay, the model label on pages, share TTL, and the viewer's task-tab behavior.\n\nCadence values are clamped by the server's policy window.`,
         });
         groups.push({