@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/dist/share-flow.d.ts

@@ -1,5 +1,5 @@
 import { saveServerEntry, deleteServerEntry, type ShareConfig, type ServerEntry } from "./config.js";
-import type { ClientApi, SessionInfo, SessionOpts } from "./core.js";
+import { type ClientApi, type SessionInfo, type SessionOpts } from "./core.js";
 import type { ShareHostApi } from "./tui-host.js";
 export type SessionBinding = {
     id: string;
@@ -8,14 +8,22 @@ export type SessionBinding = {
     url: string;
     enabled?: boolean;
     opts?: SessionOpts;
+    /** per-server "leave as-is" marker: a snapshot, not a live mirror */
+    optedOut?: boolean;
+    /** engine-recorded last create/attach refusal (quota, frozen, ...) */
+    lastError?: string;
+    /** server policy clamped the requested TTL */
+    ttlClamped?: {
+        requested: number;
+        effective: number;
+    };
 };
 export declare function pluginConfigPaths(baseDir?: string): string[];
 export declare function currentConfig(baseDir?: string): ShareConfig;
-/** Writes the config file. Target rule (owner-directed): the global
- * settings home by default, or an explicit existing file chosen in the
- * TUI — NEVER "first existing in the read chain" (that wrote TUI edits
- * into the tracked adjacent template, live-caught). $comment and foreign
- * keys preserved. */
+/** Writes the config file. Target rule: the global settings home by
+ * default, or an explicit existing file chosen in the TUI, never "first
+ * existing in the read chain" (that writes TUI edits into the tracked
+ * adjacent template). $comment and foreign keys preserved. */
 export declare function saveConfig(cfg: ShareConfig, target?: string, baseDir?: string): {
     path: string;
 } | undefined;
@@ -42,6 +50,11 @@ export declare function readBindings(client: ClientApi | undefined, sid: string)
     server: string;
     collided?: string;
 }>>;
+/** Human TTL from hours: "6h", "2d", "90d" (the TUI prompt accepts
+ * these same shapes back). */
+export declare function fmtHours(hours: number): string;
+/** Parse "6h" / "2d" / "48" into hours (bare number = hours). */
+export declare function parseTtlHours(raw: string): number | undefined;
 export declare function hostOf(url: string): string;
 /** Mutate metadata.openshare.servers[url] through a patcher (TUI per-
  * server actions: opt-out entries, collision resolution). Reads-modifies-
@@ -55,10 +68,29 @@ export declare function resolveRoot(client: ClientApi | undefined, sid: string):
 export declare function readBinding(client: ClientApi | undefined, sid: string): Promise<SessionBinding | undefined>;
 /** Sets metadata.openshare = { ...existing(v2 structure preserved),
  * enabled: true, opts? }. The per-server binding entries are the ENGINE's
- * to manage; the flag just opts the session in. */
+ * to manage; the flag just opts the session in. CONSENT ONLY: every call
+ * here means the user agreed to publish. */
 export declare function setShareFlag(client: ClientApi | undefined, sid: string, opts?: SessionOpts): Promise<boolean>;
+/** Persists per-session opts WITHOUT touching the enabled state. On an
+ * unshared session the opts sit dormant until a consented create consumes
+ * them; on a live share the engine picks them up and re-syncs the server
+ * (auth/TTL apply immediately). This must never publish anything - the
+ * TTL/auth editors use it, and consent is the only path to enabled. */
+export declare function setShareOpts(client: ClientApi | undefined, sid: string, opts: SessionOpts): Promise<boolean>;
 export declare function clearShareFlag(client: ClientApi | undefined, sid: string): Promise<boolean>;
 export declare function workerDeleteShare(workerUrl: string, id: string, secret: string): Promise<boolean>;
+/** PATCH a live share's settings over REST (#13): immediate effect with
+ * no socket required (the engine's attach-sync remains the structural
+ * path - this is the same edit pushed now, per server). Auth sends as
+ * the both-or-none pair or not at all; ttlHours only when explicit. */
+export declare function patchShareOpts(workerUrl: string, id: string, opts: {
+    authLogin?: string;
+    authPassword?: string;
+    ttlHours?: number;
+}, secret: string): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
 /** Health probe for the settings dialog's connection test. */
 export declare function probeWorker(workerUrl: string): Promise<{
     ok: boolean;
@@ -268,6 +300,40 @@ export declare function adminClient(workerUrl: string, token: string): {
         error?: string;
     }>;
 };
+/** Self-service client for the /api/me surface (the entry's user osk_
+ * token - NOT the root token). Answers "what are my limits, how many
+ * shares do I have, when does my token expire". */
+export declare function meClient(workerUrl: string, token: string): {
+    me: () => Promise<{
+        ok: boolean;
+        status: number;
+        data?: {
+            userId: string;
+            label: string;
+            token: {
+                id: string;
+                label: string;
+                limits: Record<string, number>;
+                expiresAt: number;
+            };
+            settings: Record<string, unknown>;
+        } | undefined;
+        error?: string;
+    }>;
+    myShares: () => Promise<{
+        ok: boolean;
+        status: number;
+        data?: {
+            shares: Array<{
+                id: string;
+                sessionID: string;
+                createdAt: number;
+                status: string;
+            }>;
+        } | undefined;
+        error?: string;
+    }>;
+};
 /** Resolve the admin credential for a server: the entry's adminToken, the
  * legacy createToken (when it points at this server), or prompt. */
 export declare function adminTokenFor(url: string, cfg?: ShareConfig): string;
@@ -281,8 +347,22 @@ export type FlowResult = {
     unconfigured?: boolean;
 };
 /** Consent gate: EVERY share creation asks explicitly (per owner
- * directive — no remembered consent, no silent creates). */
-export declare function requestShareConsent(host: ShareHostApi): Promise<boolean>;
+ * directive — no remembered consent, no silent creates). The dialog
+ * carries the live context (server, TTL, gate state) so the decision is
+ * informed, not ceremonial. */
+export declare function requestShareConsent(host: ShareHostApi, context?: {
+    server?: string;
+    ttlHours?: number;
+    auth: boolean;
+    counts?: {
+        messages: number;
+        toolCalls: number;
+    };
+    redaction?: {
+        hits: number;
+        samples: string[];
+    };
+}): Promise<boolean>;
 /** runShareFlow with the consent gate applied: share copies the link,
  * unshared asks consent once, then creates. Every create path routes
  * through here (/share, settings, gone-again). */

package/dist/share-flow.js

@@ -16,6 +16,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { loadConfig, moduleDir, configPaths, configHomePath, resolveServer, saveServerEntry, deleteServerEntry, METADATA_KEY } from "./config.js";
 import { dbg, dbgLog } from "./sidebar.js";
+import { engineTargetUrls, sessionStatsFor } from "./core.js";
 import { queueBindingWrite } from "./binding-queue.js";
 export function pluginConfigPaths(baseDir = moduleDir()) {
     return configPaths(baseDir);
@@ -23,11 +24,10 @@ export function pluginConfigPaths(baseDir = moduleDir()) {
 export function currentConfig(baseDir = moduleDir()) {
     return loadConfig(baseDir);
 }
-/** Writes the config file. Target rule (owner-directed): the global
- * settings home by default, or an explicit existing file chosen in the
- * TUI — NEVER "first existing in the read chain" (that wrote TUI edits
- * into the tracked adjacent template, live-caught). $comment and foreign
- * keys preserved. */
+/** Writes the config file. Target rule: the global settings home by
+ * default, or an explicit existing file chosen in the TUI, never "first
+ * existing in the read chain" (that writes TUI edits into the tracked
+ * adjacent template). $comment and foreign keys preserved. */
 export function saveConfig(cfg, target, baseDir = moduleDir()) {
     const path = target ?? configHomePath();
     if (!path)
@@ -52,8 +52,7 @@ export function saveConfig(cfg, target, baseDir = moduleDir()) {
             "debounceMs",
             "completedDelayMs",
             "modelLabel",
-            "ttlDays",
-            "openTasksInNewTab",
+            "ttlHours",
             "authLogin",
             "authPassword",
             "spoolDir",
@@ -88,8 +87,10 @@ export function serverEntries(cfg = currentConfig()) {
         for (const [url, entry] of Object.entries(cfg.servers))
             merged[url] = { ...merged[url], ...entry };
     const urls = Object.keys(merged);
-    const activeUrl = urls.find((u) => merged[u].active) ?? urls[0];
-    return urls.map((url) => ({ url, entry: merged[url], active: url === activeUrl }));
+    // EVERY explicit active is active (the engine fans out to all of them);
+    // only when none is marked does the first entry act as the default
+    const anyActive = urls.some((u) => merged[u].active);
+    return urls.map((url) => ({ url, entry: merged[url], active: anyActive ? merged[url].active === true : url === urls[0] }));
 }
 export { saveServerEntry, deleteServerEntry };
 // --- session metadata helpers -------------------------------------------------
@@ -101,6 +102,8 @@ export function bindingsOf(info) {
     const record = raw;
     const opts = record.opts ?? undefined;
     const enabled = record.enabled === true ? true : undefined;
+    const lastError = typeof record.lastError === "string" ? record.lastError : undefined;
+    const ttlClamped = record.ttlClamped && typeof record.ttlClamped === "object" ? record.ttlClamped : undefined;
     const out = [];
     if (record.servers && typeof record.servers === "object") {
         for (const [server, entry] of Object.entries(record.servers)) {
@@ -119,6 +122,9 @@ export function bindingsOf(info) {
                 opts,
                 server,
                 collided,
+                optedOut: e.optedOut === true ? true : undefined,
+                lastError,
+                ttlClamped,
             });
         }
         return out;
@@ -135,6 +141,8 @@ export function bindingsOf(info) {
             opts,
             server: "",
             collided,
+            lastError,
+            ttlClamped,
         });
     }
     return out;
@@ -143,6 +151,26 @@ export function bindingsOf(info) {
 export async function readBindings(client, sid) {
     return bindingsOf(await getSession(client, sid));
 }
+/** Human TTL from hours: "6h", "2d", "90d" (the TUI prompt accepts
+ * these same shapes back). */
+export function fmtHours(hours) {
+    if (!Number.isFinite(hours) || hours <= 0)
+        return "?";
+    if (hours % 24 === 0)
+        return `${Math.floor(hours / 24)}d`;
+    return `${Math.floor(hours)}h`;
+}
+/** Parse "6h" / "2d" / "48" into hours (bare number = hours). */
+export function parseTtlHours(raw) {
+    const m = /^\s*(\d+(?:\.\d+)?)\s*(h|d|hr|hours?|days?)?\s*$/i.exec(raw ?? "");
+    if (!m)
+        return undefined;
+    const v = Number(m[1]);
+    if (!Number.isFinite(v) || v <= 0)
+        return undefined;
+    const unit = (m[2] ?? "h").toLowerCase();
+    return Math.max(1, Math.floor(unit.startsWith("d") ? v * 24 : v));
+}
 export function hostOf(url) {
     try {
         return new URL(url).host;
@@ -230,7 +258,8 @@ export async function readBinding(client, sid) {
 }
 /** Sets metadata.openshare = { ...existing(v2 structure preserved),
  * enabled: true, opts? }. The per-server binding entries are the ENGINE's
- * to manage; the flag just opts the session in. */
+ * to manage; the flag just opts the session in. CONSENT ONLY: every call
+ * here means the user agreed to publish. */
 export async function setShareFlag(client, sid, opts) {
     const info = await getSession(client, sid);
     if (!info)
@@ -246,6 +275,27 @@ export async function setShareFlag(client, sid, opts) {
     metadata[METADATA_KEY] = value;
     return patchMetadata(client, sid, metadata);
 }
+/** Persists per-session opts WITHOUT touching the enabled state. On an
+ * unshared session the opts sit dormant until a consented create consumes
+ * them; on a live share the engine picks them up and re-syncs the server
+ * (auth/TTL apply immediately). This must never publish anything - the
+ * TTL/auth editors use it, and consent is the only path to enabled. */
+export async function setShareOpts(client, sid, opts) {
+    const info = await getSession(client, sid);
+    if (!info)
+        return false;
+    const metadata = { ...(info.metadata ?? {}) };
+    const existing = info.metadata?.[METADATA_KEY];
+    const value = existing && typeof existing === "object"
+        ? { ...existing }
+        : { v: 2, servers: {} };
+    if (Object.keys(opts).length)
+        value.opts = opts;
+    else
+        delete value.opts;
+    metadata[METADATA_KEY] = value;
+    return patchMetadata(client, sid, metadata);
+}
 export async function clearShareFlag(client, sid) {
     const info = await getSession(client, sid);
     if (!info)
@@ -269,6 +319,32 @@ export async function workerDeleteShare(workerUrl, id, secret) {
         return false;
     }
 }
+/** PATCH a live share's settings over REST (#13): immediate effect with
+ * no socket required (the engine's attach-sync remains the structural
+ * path - this is the same edit pushed now, per server). Auth sends as
+ * the both-or-none pair or not at all; ttlHours only when explicit. */
+export async function patchShareOpts(workerUrl, id, opts, secret) {
+    const body = { secret };
+    if (opts.authLogin !== undefined && opts.authPassword !== undefined) {
+        body.authLogin = opts.authLogin;
+        body.authPassword = opts.authPassword;
+    }
+    if (opts.ttlHours !== undefined)
+        body.ttlHours = opts.ttlHours;
+    try {
+        const res = await fetch(`${workerUrl.replace(/\/$/, "")}/api/share/${id}`, {
+            method: "PATCH",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(8000),
+        });
+        const json = (await res.json().catch(() => ({})));
+        return res.ok && json.ok ? { ok: true } : { ok: false, error: json.error ?? `HTTP ${res.status}` };
+    }
+    catch (e) {
+        return { ok: false, error: e?.message || String(e) };
+    }
+}
 /** Health probe for the settings dialog's connection test. */
 export async function probeWorker(workerUrl) {
     if (!workerUrl)
@@ -430,6 +506,32 @@ export function adminClient(workerUrl, token) {
         health: () => call("GET", "/health"),
     };
 }
+/** Self-service client for the /api/me surface (the entry's user osk_
+ * token - NOT the root token). Answers "what are my limits, how many
+ * shares do I have, when does my token expire". */
+export function meClient(workerUrl, token) {
+    const base = normServerUrl(workerUrl);
+    const call = async (method, path) => {
+        try {
+            const res = await fetch(`${base}${path}`, {
+                method,
+                headers: { authorization: `Bearer ${token}` },
+                signal: AbortSignal.timeout(12000),
+            });
+            const parsed = (await res.json().catch(() => ({})));
+            if (!res.ok)
+                return { ok: false, status: res.status, error: parsed?.error ?? `HTTP ${res.status}` };
+            return { ok: parsed?.ok !== false, status: res.status, data: parsed, error: parsed?.error };
+        }
+        catch (error) {
+            return { ok: false, status: 0, error: error.message };
+        }
+    };
+    return {
+        me: () => call("GET", "/api/me"),
+        myShares: () => call("GET", "/api/me/shares"),
+    };
+}
 /** Resolve the admin credential for a server: the entry's adminToken, the
  * legacy createToken (when it points at this server), or prompt. */
 export function adminTokenFor(url, cfg = currentConfig()) {
@@ -452,11 +554,26 @@ export async function waitForBinding(client, sid, timeoutMs = 25000) {
     return undefined;
 }
 /** Consent gate: EVERY share creation asks explicitly (per owner
- * directive — no remembered consent, no silent creates). */
-export async function requestShareConsent(host) {
+ * directive — no remembered consent, no silent creates). The dialog
+ * carries the live context (server, TTL, gate state) so the decision is
+ * informed, not ceremonial. */
+export async function requestShareConsent(host, context) {
+    const lines = ["Publish this session (and its subagent sessions) to your openshare worker?"];
+    if (context) {
+        const bits = [];
+        if (context.server)
+            bits.push(`server: ${context.server}`);
+        if (context.ttlHours !== undefined)
+            bits.push(`TTL: ${fmtHours(context.ttlHours)}`);
+        if (context.redaction && context.redaction.hits > 0)
+            bits.push(`redaction: ${context.redaction.hits} hit(s)`);
+        bits.push(`read auth: ${context.auth ? "on" : "off"}`);
+        lines.push(bits.join(" - "));
+    }
+    lines.push("Anyone with the link can read the conversation (login-gated only when read auth is on).");
     return host.ui.showConfirm({
         title: "Share Session",
-        message: "Publish this session (and its subagent sessions) to your openshare worker?\nThe link lets anyone with it read the conversation.",
+        message: lines.join("\n"),
         confirmLabel: "Share",
     });
 }
@@ -467,18 +584,37 @@ export async function shareWithConsent(host, sessionID) {
     if (!sessionID)
         return { ok: false, message: "No active session to share." };
     const cfg = currentConfig();
-    if (!isConfigured(cfg)) {
-        return { ok: false, message: "No share server connected — run /openshare to connect one.", unconfigured: true };
+    // engine-aware: plugin-options-layer config can target servers the file
+    // chain cannot see (TUI blindness would push onboarding at a configured user)
+    if (!isConfigured(cfg) && !engineTargetUrls().length) {
+        return { ok: false, message: "No share server connected - run /openshare to connect one.", unconfigured: true };
     }
     const root = await resolveRoot(host.client, sessionID);
-    const existing = await readBinding(host.client, root);
-    if (existing?.url && existing.enabled !== false) {
+    const all = await readBindings(host.client, root);
+    // fully opted-out (leave-as-is everywhere) is NOT live: consent again
+    // instead of silently copying a snapshot link
+    const live = all.find((b) => b.url && b.enabled !== false && !b.optedOut);
+    if (live) {
         // already sharing: copy the link
-        await host.clipboard.write(existing.url);
-        return { ok: true, message: `Share URL copied to clipboard: ${existing.url}`, url: existing.url };
+        await host.clipboard.write(live.url);
+        return { ok: true, message: `Share URL copied to clipboard: ${live.url}`, url: live.url };
+    }
+    const opts = all[0]?.opts;
+    const server = serverEntries(cfg).find((s) => s.active) ?? serverEntries(cfg)[0] ?? (engineTargetUrls()[0] ? { url: engineTargetUrls()[0] } : undefined);
+    {
+        const stats = sessionStatsFor(root);
+        const gated = !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword);
+        if (!(await requestShareConsent(host, {
+            server: server ? hostOf(server.url) : undefined,
+            ttlHours: opts?.ttlHours ?? cfg.ttlHours,
+            auth: gated,
+            counts: { messages: stats.messages, toolCalls: stats.toolCalls },
+            // redaction only runs on ungated shares (a gated share is
+            // private from casual observers; the ledger reflects that)
+            redaction: gated ? undefined : { hits: stats.redaction.count, samples: stats.redaction.samples.map((h) => `${h.sample} [${h.kind}]`) },
+        })))
+            return { ok: false, message: "Share cancelled." };
     }
-    if (!(await requestShareConsent(host)))
-        return { ok: false, message: "Share cancelled." };
     return confirmShare(host, root);
 }
 /** Post-consent share: set the flag, wait for the URL, copy it. */
@@ -488,12 +624,26 @@ export async function confirmShare(host, rootSessionID) {
     dbgLog(`confirmShare: setShareFlag -> ${set}`);
     if (!set)
         return { ok: false, message: "Could not write the share flag into session metadata." };
+    // fresh consent: clear any leave-as-is markers so the engine re-arms
+    // (re-attaching the same pages wherever the secrets still exist)
+    await patchSessionBinding(host.client, rootSessionID, (servers) => {
+        for (const e of Object.values(servers)) {
+            if (e && typeof e === "object")
+                delete e.optedOut;
+        }
+    });
     const binding = await waitForBinding(host.client, rootSessionID);
     dbgLog(`confirmShare: waitForBinding -> ${binding?.url ? binding.url : "timeout"}`);
     if (!binding?.url) {
+        // a failed create must NOT leave the flag armed: the engine would
+        // publish LATER with no further consent. Disarm now; re-running
+        // /share re-consents.
+        await clearShareFlag(host.client, rootSessionID);
+        const fresh = await readBinding(host.client, rootSessionID);
+        const why = fresh?.lastError ? `\nReason: ${fresh.lastError}` : "";
         return {
             ok: false,
-            message: "Share did not come up (timeout waiting for the URL). Is the worker reachable? Check the server plugin log for [openshare] lines.",
+            message: `Share did not come up (timed out waiting for the URL); the share flag was disarmed.${why}\nCheck the [openshare] stderr lines for details.`,
         };
     }
     await host.clipboard.write(binding.url);