@mirrowel/opencode-openshare 0.2.0 → 0.3.0-dev.1

package/dist/tui.js

@@ -22,12 +22,13 @@ var DEFAULTS = {
   debounceMs: 1e4,
   completedDelayMs: 5000,
   modelLabel: "$Provider/$Model",
-  ttlDays: 90,
-  openTasksInNewTab: true,
+  ttlHours: 90 * 24,
   authLogin: "",
   authPassword: "",
   spoolDir: "",
   urlFile: "",
+  urlFileFormat: "url",
+  configSet: "",
   announceStderr: true
 };
 var CONFIG_NAME = "openshare.config.json";
@@ -98,10 +99,13 @@ function configSourceMap(pluginDir, env = process.env) {
     debounceMs: env.OPENSHARE_DEBOUNCE_MS,
     completedDelayMs: env.OPENSHARE_COMPLETED_DELAY_MS,
     modelLabel: env.OPENSHARE_MODEL_LABEL,
+    ttlHours: env.OPENSHARE_TTL_HOURS,
     ttlDays: env.OPENSHARE_TTL_DAYS,
     authLogin: env.OPENSHARE_AUTH_LOGIN,
     authPassword: env.OPENSHARE_AUTH_PASSWORD,
     urlFile: env.OPENSHARE_URL_FILE,
+    urlFileFormat: env.OPENSHARE_URL_FILE_FORMAT,
+    configSet: env.OPENSHARE_CONFIG_SET,
     spoolDir: env.OPENSHARE_SPOOL_DIR,
     announceStderr: env.OPENSHARE_ANNOUNCE_STDERR,
     shareMode: env.OPENSHARE_SHARE_MODE
@@ -110,6 +114,24 @@ function configSourceMap(pluginDir, env = process.env) {
     if (value !== undefined && value !== "")
       sources[key] = "environment";
   }
+  if (sources.ttlDays && !sources.ttlHours)
+    sources.ttlHours = sources.ttlDays;
+  delete sources.ttlDays;
+  if (env.OPENSHARE_CONFIG_JSON) {
+    try {
+      const raw = JSON.parse(env.OPENSHARE_CONFIG_JSON);
+      if (raw && typeof raw === "object") {
+        for (const [key, value] of Object.entries(raw)) {
+          if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+            continue;
+          if (sources[key] === "environment")
+            continue;
+          if (key === "servers" || known.has(key))
+            sources[key] = "OPENSHARE_CONFIG_JSON";
+        }
+      }
+    } catch {}
+  }
   for (const path of configPaths(pluginDir, env)) {
     let raw;
     try {
@@ -163,6 +185,8 @@ function normalizeServers(raw) {
       entry.adminToken = e.adminToken;
     if (e.active === true)
       entry.active = true;
+    if (e.anonymous === true)
+      entry.anonymous = true;
     out[url] = entry;
   }
   return Object.keys(out).length ? out : undefined;
@@ -232,27 +256,57 @@ function loadConfig(pluginDir, options) {
   const cfg = { ...DEFAULTS };
   const emptyMeansUnset = new Set(["workerUrl", "createToken", "urlFile", "spoolDir"]);
   const known = new Set([...Object.keys(DEFAULTS), "shareMode"]);
-  for (const path of [...configPaths(pluginDir)].reverse()) {
-    try {
-      const raw = JSON.parse(readFileSync(path, "utf8"));
-      if (!raw || typeof raw !== "object")
+  const applyObject = (raw) => {
+    if (!raw || typeof raw !== "object")
+      return;
+    for (const [key, value] of Object.entries(raw)) {
+      if (key === "servers") {
+        const servers = normalizeServers(value);
+        if (servers)
+          cfg.servers = mergeServerGroups(cfg.servers, servers);
         continue;
-      for (const [key, value] of Object.entries(raw)) {
-        if (key === "servers") {
-          const servers = normalizeServers(value);
-          if (servers)
-            cfg.servers = mergeServerGroups(cfg.servers, servers);
-          continue;
+      }
+      if (key === "redact") {
+        if (value && typeof value === "object" && Array.isArray(value.patterns)) {
+          const pats = value.patterns.filter((x) => typeof x === "string" && x.length > 0 && x.length < 500).slice(0, 50);
+          cfg.redact = { patterns: pats };
         }
-        if (!known.has(key))
-          continue;
-        if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
-          continue;
-        if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
-          continue;
-        cfg[key] = value;
+        continue;
       }
-    } catch {}
+      if (key === "meta") {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          const clean = {};
+          for (const [mk, mv] of Object.entries(value)) {
+            if (typeof mv === "string" && mv.length <= 500 && mk.length <= 64)
+              clean[mk] = mv;
+          }
+          if (Object.keys(clean).length)
+            cfg.meta = { ...cfg.meta, ...clean };
+        }
+        continue;
+      }
+      if (key === "ttlDays") {
+        const d = Math.floor(Number(value));
+        if (Number.isFinite(d) && d > 0)
+          cfg.ttlHours = d * 24;
+        continue;
+      }
+      if (!known.has(key))
+        continue;
+      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        continue;
+      if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
+        continue;
+      cfg[key] = value;
+    }
+  };
+  for (const path of [...configPaths(pluginDir)].reverse()) {
+    try {
+      applyObject(JSON.parse(readFileSync(path, "utf8")));
+    } catch (e) {
+      if (existsSync(path))
+        console.error(`[openshare] config file ${path} could not be parsed - ignored:`, e?.message ?? e);
+    }
   }
   if (options && typeof options === "object") {
     const serversOpt = normalizeServers(options.servers);
@@ -271,6 +325,13 @@ function loadConfig(pluginDir, options) {
       cfg.shareMode = mode;
   }
   const env = process.env;
+  if (env.OPENSHARE_CONFIG_JSON) {
+    try {
+      applyObject(JSON.parse(env.OPENSHARE_CONFIG_JSON));
+    } catch (e) {
+      console.error("[openshare] OPENSHARE_CONFIG_JSON could not be parsed - ignored:", e?.message ?? e);
+    }
+  }
   if (env.OPENSHARE_WORKER_URL)
     cfg.workerUrl = env.OPENSHARE_WORKER_URL;
   if (env.OPENSHARE_CREATE_TOKEN)
@@ -281,14 +342,20 @@ function loadConfig(pluginDir, options) {
     cfg.completedDelayMs = num(env.OPENSHARE_COMPLETED_DELAY_MS, cfg.completedDelayMs);
   if (env.OPENSHARE_MODEL_LABEL !== undefined)
     cfg.modelLabel = env.OPENSHARE_MODEL_LABEL;
+  if (env.OPENSHARE_TTL_HOURS)
+    cfg.ttlHours = num(env.OPENSHARE_TTL_HOURS, cfg.ttlHours);
   if (env.OPENSHARE_TTL_DAYS)
-    cfg.ttlDays = num(env.OPENSHARE_TTL_DAYS, cfg.ttlDays);
+    cfg.ttlHours = Math.max(1, Math.floor(num(env.OPENSHARE_TTL_DAYS, 90) * 24));
   if (env.OPENSHARE_AUTH_LOGIN !== undefined)
     cfg.authLogin = env.OPENSHARE_AUTH_LOGIN;
   if (env.OPENSHARE_AUTH_PASSWORD !== undefined)
     cfg.authPassword = env.OPENSHARE_AUTH_PASSWORD;
   if (env.OPENSHARE_URL_FILE !== undefined)
     cfg.urlFile = env.OPENSHARE_URL_FILE;
+  if (env.OPENSHARE_URL_FILE_FORMAT === "json" || env.OPENSHARE_URL_FILE_FORMAT === "url")
+    cfg.urlFileFormat = env.OPENSHARE_URL_FILE_FORMAT;
+  if (env.OPENSHARE_CONFIG_SET)
+    cfg.configSet = env.OPENSHARE_CONFIG_SET;
   if (env.OPENSHARE_SPOOL_DIR)
     cfg.spoolDir = env.OPENSHARE_SPOOL_DIR;
   if (env.OPENSHARE_ANNOUNCE_STDERR !== undefined)
@@ -297,6 +364,14 @@ function loadConfig(pluginDir, options) {
     cfg.shareMode = env.OPENSHARE_SHARE_MODE;
   if (cfg.urlFile.trim().toLowerCase() === URL_FILE_NONE)
     cfg.urlFile = URL_FILE_NONE;
+  if (cfg.workerUrl)
+    cfg.workerUrl = cfg.workerUrl.trim().replace(/\/+$/, "");
+  if (cfg.servers) {
+    const fixed = {};
+    for (const [u, e] of Object.entries(cfg.servers))
+      fixed[u.trim().replace(/\/+$/, "")] = e;
+    cfg.servers = fixed;
+  }
   return cfg;
 }
 function globalConfigDir(env) {
@@ -434,6 +509,22 @@ function queueBindingWrite(sid, fn) {
   return run;
 }
 
+// src/redact.ts
+var PATH_KEYS = new Set(["file", "path", "filePath", "cwd", "directory", "root"]);
+
+// src/core.ts
+var liveTargets = [];
+var statsProvider = null;
+var redactionLedger = new Map;
+function sessionStatsFor(sid) {
+  const led = redactionLedger.get(sid) ?? { count: 0, samples: [] };
+  const counts = statsProvider ? statsProvider(sid) : { messages: 0, toolCalls: 0 };
+  return { ...counts, redaction: led };
+}
+function engineTargetUrls() {
+  return liveTargets;
+}
+
 // src/share-flow.ts
 function currentConfig(baseDir = moduleDir()) {
   return loadConfig(baseDir);
@@ -458,8 +549,7 @@ function saveConfig(cfg, target, baseDir = moduleDir()) {
       "debounceMs",
       "completedDelayMs",
       "modelLabel",
-      "ttlDays",
-      "openTasksInNewTab",
+      "ttlHours",
       "authLogin",
       "authPassword",
       "spoolDir",
@@ -490,8 +580,8 @@ function serverEntries(cfg = currentConfig()) {
     for (const [url, entry] of Object.entries(cfg.servers))
       merged[url] = { ...merged[url], ...entry };
   const urls = Object.keys(merged);
-  const activeUrl = urls.find((u) => merged[u].active) ?? urls[0];
-  return urls.map((url) => ({ url, entry: merged[url], active: url === activeUrl }));
+  const anyActive = urls.some((u) => merged[u].active);
+  return urls.map((url) => ({ url, entry: merged[url], active: anyActive ? merged[url].active === true : url === urls[0] }));
 }
 function bindingsOf(info) {
   const raw = info?.metadata?.[METADATA_KEY];
@@ -500,6 +590,8 @@ function bindingsOf(info) {
   const record = raw;
   const opts = record.opts ?? undefined;
   const enabled = record.enabled === true ? true : undefined;
+  const lastError = typeof record.lastError === "string" ? record.lastError : undefined;
+  const ttlClamped = record.ttlClamped && typeof record.ttlClamped === "object" ? record.ttlClamped : undefined;
   const out = [];
   if (record.servers && typeof record.servers === "object") {
     for (const [server, entry] of Object.entries(record.servers)) {
@@ -517,7 +609,10 @@ function bindingsOf(info) {
         enabled,
         opts,
         server,
-        collided
+        collided,
+        optedOut: e.optedOut === true ? true : undefined,
+        lastError,
+        ttlClamped
       });
     }
     return out;
@@ -532,7 +627,9 @@ function bindingsOf(info) {
       enabled,
       opts,
       server: "",
-      collided
+      collided,
+      lastError,
+      ttlClamped
     });
   }
   return out;
@@ -540,6 +637,23 @@ function bindingsOf(info) {
 async function readBindings(client, sid) {
   return bindingsOf(await getSession(client, sid));
 }
+function fmtHours(hours) {
+  if (!Number.isFinite(hours) || hours <= 0)
+    return "?";
+  if (hours % 24 === 0)
+    return `${Math.floor(hours / 24)}d`;
+  return `${Math.floor(hours)}h`;
+}
+function parseTtlHours(raw) {
+  const m = /^\s*(\d+(?:\.\d+)?)\s*(h|d|hr|hours?|days?)?\s*$/i.exec(raw ?? "");
+  if (!m)
+    return;
+  const v = Number(m[1]);
+  if (!Number.isFinite(v) || v <= 0)
+    return;
+  const unit = (m[2] ?? "h").toLowerCase();
+  return Math.max(1, Math.floor(unit.startsWith("d") ? v * 24 : v));
+}
 function hostOf(url) {
   try {
     return new URL(url).host;
@@ -626,6 +740,20 @@ async function setShareFlag(client, sid, opts) {
   metadata[METADATA_KEY] = value;
   return patchMetadata(client, sid, metadata);
 }
+async function setShareOpts(client, sid, opts) {
+  const info = await getSession(client, sid);
+  if (!info)
+    return false;
+  const metadata = { ...info.metadata ?? {} };
+  const existing = info.metadata?.[METADATA_KEY];
+  const value = existing && typeof existing === "object" ? { ...existing } : { v: 2, servers: {} };
+  if (Object.keys(opts).length)
+    value.opts = opts;
+  else
+    delete value.opts;
+  metadata[METADATA_KEY] = value;
+  return patchMetadata(client, sid, metadata);
+}
 async function clearShareFlag(client, sid) {
   const info = await getSession(client, sid);
   if (!info)
@@ -647,6 +775,27 @@ async function workerDeleteShare(workerUrl, id, secret) {
     return false;
   }
 }
+async function patchShareOpts(workerUrl, id, opts, secret) {
+  const body = { secret };
+  if (opts.authLogin !== undefined && opts.authPassword !== undefined) {
+    body.authLogin = opts.authLogin;
+    body.authPassword = opts.authPassword;
+  }
+  if (opts.ttlHours !== undefined)
+    body.ttlHours = opts.ttlHours;
+  try {
+    const res = await fetch(`${workerUrl.replace(/\/$/, "")}/api/share/${id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(8000)
+    });
+    const json = await res.json().catch(() => ({}));
+    return res.ok && json.ok ? { ok: true } : { ok: false, error: json.error ?? `HTTP ${res.status}` };
+  } catch (e) {
+    return { ok: false, error: e?.message || String(e) };
+  }
+}
 async function probeWorker(workerUrl) {
   if (!workerUrl)
     return { ok: false, detail: "workerUrl is empty" };
@@ -786,6 +935,28 @@ function adminClient(workerUrl, token) {
     health: () => call("GET", "/health")
   };
 }
+function meClient(workerUrl, token) {
+  const base = normServerUrl(workerUrl);
+  const call = async (method, path) => {
+    try {
+      const res = await fetch(`${base}${path}`, {
+        method,
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(12000)
+      });
+      const parsed = await res.json().catch(() => ({}));
+      if (!res.ok)
+        return { ok: false, status: res.status, error: parsed?.error ?? `HTTP ${res.status}` };
+      return { ok: parsed?.ok !== false, status: res.status, data: parsed, error: parsed?.error };
+    } catch (error) {
+      return { ok: false, status: 0, error: error.message };
+    }
+  };
+  return {
+    me: () => call("GET", "/api/me"),
+    myShares: () => call("GET", "/api/me/shares")
+  };
+}
 function adminTokenFor(url, cfg = currentConfig()) {
   const base = normServerUrl(url);
   const entry = serverEntries(cfg).find((s) => s.url === base);
@@ -802,11 +973,24 @@ async function waitForBinding(client, sid, timeoutMs = 25000) {
   }
   return;
 }
-async function requestShareConsent(host) {
+async function requestShareConsent(host, context) {
+  const lines = ["Publish this session (and its subagent sessions) to your openshare worker?"];
+  if (context) {
+    const bits = [];
+    if (context.server)
+      bits.push(`server: ${context.server}`);
+    if (context.ttlHours !== undefined)
+      bits.push(`TTL: ${fmtHours(context.ttlHours)}`);
+    if (context.redaction && context.redaction.hits > 0)
+      bits.push(`redaction: ${context.redaction.hits} hit(s)`);
+    bits.push(`read auth: ${context.auth ? "on" : "off"}`);
+    lines.push(bits.join(" - "));
+  }
+  lines.push("Anyone with the link can read the conversation (login-gated only when read auth is on).");
   return host.ui.showConfirm({
     title: "Share Session",
-    message: `Publish this session (and its subagent sessions) to your openshare worker?
-The link lets anyone with it read the conversation.`,
+    message: lines.join(`
+`),
     confirmLabel: "Share"
   });
 }
@@ -814,17 +998,30 @@ async function shareWithConsent(host, sessionID) {
   if (!sessionID)
     return { ok: false, message: "No active session to share." };
   const cfg = currentConfig();
-  if (!isConfigured(cfg)) {
-    return { ok: false, message: "No share server connected \u2014 run /openshare to connect one.", unconfigured: true };
+  if (!isConfigured(cfg) && !engineTargetUrls().length) {
+    return { ok: false, message: "No share server connected - run /openshare to connect one.", unconfigured: true };
   }
   const root = await resolveRoot(host.client, sessionID);
-  const existing = await readBinding(host.client, root);
-  if (existing?.url && existing.enabled !== false) {
-    await host.clipboard.write(existing.url);
-    return { ok: true, message: `Share URL copied to clipboard: ${existing.url}`, url: existing.url };
+  const all = await readBindings(host.client, root);
+  const live = all.find((b) => b.url && b.enabled !== false && !b.optedOut);
+  if (live) {
+    await host.clipboard.write(live.url);
+    return { ok: true, message: `Share URL copied to clipboard: ${live.url}`, url: live.url };
+  }
+  const opts = all[0]?.opts;
+  const server = serverEntries(cfg).find((s) => s.active) ?? serverEntries(cfg)[0] ?? (engineTargetUrls()[0] ? { url: engineTargetUrls()[0] } : undefined);
+  {
+    const stats = sessionStatsFor(root);
+    const gated = !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword);
+    if (!await requestShareConsent(host, {
+      server: server ? hostOf(server.url) : undefined,
+      ttlHours: opts?.ttlHours ?? cfg.ttlHours,
+      auth: gated,
+      counts: { messages: stats.messages, toolCalls: stats.toolCalls },
+      redaction: gated ? undefined : { hits: stats.redaction.count, samples: stats.redaction.samples.map((h) => `${h.sample} [${h.kind}]`) }
+    }))
+      return { ok: false, message: "Share cancelled." };
   }
-  if (!await requestShareConsent(host))
-    return { ok: false, message: "Share cancelled." };
   return confirmShare(host, root);
 }
 async function confirmShare(host, rootSessionID) {
@@ -833,12 +1030,23 @@ async function confirmShare(host, rootSessionID) {
   dbgLog(`confirmShare: setShareFlag -> ${set}`);
   if (!set)
     return { ok: false, message: "Could not write the share flag into session metadata." };
+  await patchSessionBinding(host.client, rootSessionID, (servers) => {
+    for (const e of Object.values(servers)) {
+      if (e && typeof e === "object")
+        delete e.optedOut;
+    }
+  });
   const binding = await waitForBinding(host.client, rootSessionID);
   dbgLog(`confirmShare: waitForBinding -> ${binding?.url ? binding.url : "timeout"}`);
   if (!binding?.url) {
+    await clearShareFlag(host.client, rootSessionID);
+    const fresh = await readBinding(host.client, rootSessionID);
+    const why = fresh?.lastError ? `
+Reason: ${fresh.lastError}` : "";
     return {
       ok: false,
-      message: "Share did not come up (timeout waiting for the URL). Is the worker reachable? Check the server plugin log for [openshare] lines."
+      message: `Share did not come up (timed out waiting for the URL); the share flag was disarmed.${why}
+Check the [openshare] stderr lines for details.`
     };
   }
   await host.clipboard.write(binding.url);
@@ -944,13 +1152,15 @@ Regular users should NOT hold the root token: connect via an access code instead
   },
   shareMode: {
     label: "Share mode",
-    help: '"all" shares every session; "manual" needs /share. Default: TUI presence.',
+    help: '"all" shares every session; "manual" needs /share. Default: TUI presence. Takes effect after opencode restarts.',
     kind: "text",
     options: ["auto", "all", "manual"],
     section: "Sharing",
-    info: `all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared \u2014 share those explicitly. manual: sessions stay private until you run /share.
+    info: `all: every NEW session shares automatically (CI posture). Sessions that existed before the plugin started are never auto-shared - share those explicitly. manual: sessions stay private until you run /share.
 
-Default (empty): TUI presence decides \u2014 installing the TUI part means manual, server-only means all.`,
+Default (empty): TUI presence decides - installing the TUI part means manual, server-only means all.
+
+NOTE: the mode is resolved once at plugin load. Changing it here saves immediately but only takes effect after opencode restarts - until then new sessions keep following the OLD mode.`,
     def: "auto (TUI presence)"
   },
   debounceMs: {
@@ -981,24 +1191,15 @@ A graceful opencode exit flushes the pending flip, so CI runs land their final s
     info: 'How the model name appears on the share page. "$Provider/$Model" renders e.g. "closedrouter/zai/glm-5.3". Any literal text is used as-is; empty string hides the model line entirely.',
     def: '"$Provider/$Model"'
   },
-  ttlDays: {
-    label: "TTL (days)",
-    help: "Share lifetime; the worker caps it at its MAX_TTL_DAYS.",
+  ttlHours: {
+    label: "TTL (hours)",
+    help: "Share lifetime in hours (2d writes 48); capped server-side.",
     kind: "number",
     section: "Sharing",
-    info: `How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.
+    info: `How long pages live before the server's sweeper deletes them, in HOURS. Capped server-side: the deployment's MAX_TTL_HOURS (legacy MAX_TTL_DAYS converted) and the token's limit both apply; the floor is one hour.
 
-A per-session override lives in the This-session section; it is sent at create/attach time.`,
-    def: "worker cap (90 on the reference deployment)"
-  },
-  openTasksInNewTab: {
-    label: "Open tasks in new tab",
-    help: "Viewer: task rows open subagent pages in a new tab.",
-    kind: "text",
-    options: ["true", "false"],
-    section: "Sharing",
-    info: "Viewer behavior only: clicking a task (subagent) row opens its sub-page in a new browser tab instead of navigating. true/false.",
-    def: "true"
+A per-session override lives in the This-session section; it is sent at create/attach time. The session prompt takes 6h / 2d style input.`,
+    def: "worker cap (2160h = 90d on the reference deployment)"
   },
   authLogin: {
     label: "Read auth: login",
@@ -1063,10 +1264,8 @@ function helpForKey(key, cfg, sources) {
 function displayValue(key, cfg) {
   if (key === "createToken" || key === "authPassword")
     return mask(String(cfg[key] ?? ""));
-  if (key === "openTasksInNewTab")
-    return String(cfg.openTasksInNewTab !== false);
   if (key === "announceStderr")
-    return String(cfg.announceStderr !== false);
+    return cfg.announceStderr !== false ? "on" : "off";
   const value = cfg[key];
   return value === undefined || value === "" ? "(not set)" : String(value);
 }
@@ -1090,7 +1289,7 @@ async function editKey(host, cfg, key) {
     const next = { ...cfg };
     if (key === "shareMode")
       next[key] = picked === "auto" ? undefined : picked;
-    else if (key === "openTasksInNewTab" || key === "announceStderr")
+    else if (key === "announceStderr")
       next[key] = picked === "true";
     else
       next[key] = picked;
@@ -1125,26 +1324,74 @@ async function connectServerFlow(host) {
   const url = normServerUrl(raw);
   if (!/^https?:\/\//.test(url))
     return { ok: false, message: "URL must start with http:// or https://" };
-  host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}\u2026` });
+  host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}:` });
   const probe = await probeAuthMode(url);
   if (!probe.ok)
     return { ok: false, message: `${url}: ${probe.detail}` };
-  let code = "";
-  if (probe.mode === "private") {
-    const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_\u2026 (from the hoster)" });
+  const existing = serverEntries().find((sv) => sv.url === url)?.entry ?? {};
+  const deactivateOthers = () => {
+    for (const other of serverEntries()) {
+      if (other.url !== url)
+        saveServerEntry(other.url, { active: undefined });
+    }
+  };
+  if (probe.mode === "public") {
+    const picked = await showSelect(host.ui, {
+      title: `${url} - account?`,
+      options: [
+        {
+          value: "onboard",
+          title: "Onboard (get an account)",
+          description: "your own user, tokens and share limits; survives the server's anonymous caps",
+          help: "An account gives you a revocable identity with your own share registry and limits. Depending on the server you may need a one-time access code from the hoster - you'll be asked only if it's required."
+        },
+        {
+          value: "anon",
+          title: "Stay anonymous",
+          description: "share without an account; counts against the server-wide anonymous limits",
+          help: "No identity, no token to manage. Shares are ownerless: whoever holds the share's secret controls them, and the server may throttle anonymous creates globally. You can onboard later from Servers -> the server -> Enroll now."
+        }
+      ]
+    });
+    if (picked === "anon") {
+      saveServerEntry(url, { ...existing.token ? {} : { anonymous: true }, label: existing.label, active: true });
+      return { ok: true, message: `Connected to ${url} anonymously - sharing works, no account.`, url };
+    }
+    if (picked === undefined || picked === null)
+      return { ok: false, message: "Cancelled." };
+    let code = existing.code ?? "";
+    if (!code) {
+      const free = await enrollAtServer(url, "");
+      if (free.ok) {
+        deactivateOthers();
+        saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined, active: true });
+        return { ok: true, message: `Connected to ${url} as "${free.label}" - sharing goes there now.`, url };
+      }
+      const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
+      if (typed === undefined)
+        return { ok: false, message: "Cancelled - this server needs a code to onboard." };
+      code = typed.trim();
+    }
+    const res = await enrollAtServer(url, code);
+    if (!res.ok)
+      return { ok: false, message: `Enrollment refused: ${res.error}` };
+    deactivateOthers();
+    saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, anonymous: undefined, active: true });
+    return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url };
+  }
+  let code = existing.code ?? "";
+  if (!code) {
+    const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
     if (typed === undefined)
-      return { ok: false, message: "Cancelled \u2014 private servers need a code." };
+      return { ok: false, message: "Cancelled - private servers need a code." };
     code = typed.trim();
   }
   const res = await enrollAtServer(url, code);
   if (!res.ok)
     return { ok: false, message: `Enrollment refused: ${res.error}` };
-  for (const other of serverEntries()) {
-    if (other.url !== url)
-      saveServerEntry(other.url, { active: undefined });
-  }
+  deactivateOthers();
   saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, active: true });
-  return { ok: true, message: `Connected to ${url} as "${res.label}" \u2014 sharing goes there now.`, url };
+  return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url };
 }
 async function serverMenu(host, url) {
   while (true) {
@@ -1153,7 +1400,7 @@ async function serverMenu(host, url) {
     if (!mine)
       return;
     const holdsRoot = !!mine.entry.token && mine.entry.token === (mine.entry.adminToken ?? adminTokenFor(url));
-    const cred = holdsRoot ? `ROOT token ${mask(mine.entry.token)} \u2014 admin, no user identity` : mine.entry.token ? `token ${mask(mine.entry.token)}` : mine.entry.code ? "no token (code saved, enrolls on demand)" : "no token (public server, enrolls on demand)";
+    const cred = holdsRoot ? `ROOT token ${mask(mine.entry.token)} \u2014 admin, no user identity` : mine.entry.token ? `token ${mask(mine.entry.token)}` : mine.entry.code ? "no token (code saved, enrolls on demand)" : mine.entry.anonymous ? "anonymous (declined onboarding)" : "no token (public server, shares anonymously)";
     const options = [
       { title: url, value: "info", description: `${mine.entry.label ?? "(no label)"} \xB7 ${cred}${mine.active ? " \xB7 ACTIVE" : ""}`, disabled: true }
     ];
@@ -1173,6 +1420,8 @@ This creates your own user on ${url} (label prompt, prefilled), mints its token,
       options.push({ title: "Enroll now", value: "enroll", description: holdsRoot ? "join as a user via code/public enrollment" : "get a user token immediately" });
     if (mine.entry.token && !holdsRoot)
       options.push({ title: "Rotate token", value: "rotate", description: "new token, old one revoked" });
+    if (mine.entry.token && !holdsRoot)
+      options.push({ title: "Your account", value: "account", description: "limits, token expiry, your shares" });
     if (mine.entry.token && !holdsRoot)
       options.push({ title: "Disconnect", value: "disconnect", description: "revoke the token server-side and forget it", danger: true });
     options.push({
@@ -1190,12 +1439,13 @@ Needs the server's root CREATE_TOKEN (saved admin token used first; prompted oth
     if (choice === undefined || choice === "__back")
       return;
     if (choice === "active") {
-      for (const other of entries) {
-        if (other.url !== url)
-          saveServerEntry(other.url, { active: undefined });
-      }
       saveServerEntry(url, { active: true });
-      host.ui.toast({ variant: "success", title: "OpenShare", message: `${url} is now the active server.` });
+      const stillActive = serverEntries().filter((s) => s.active);
+      host.ui.toast({
+        variant: "success",
+        title: "OpenShare",
+        message: stillActive.length > 1 ? `${url} is primary - ${stillActive.length} servers stay ACTIVE (fan-out): new sessions mirror to all of them.` : `${url} is now the active server.`
+      });
       return;
     }
     if (choice === "adopt") {
@@ -1230,8 +1480,18 @@ Needs the server's root CREATE_TOKEN (saved admin token used first; prompted oth
         continue;
       }
       let code = mine.entry.code ?? "";
-      if (probe.mode === "private" && !code) {
-        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_\u2026 (from the hoster)" });
+      if (!code) {
+        const free = await enrollAtServer(url, "");
+        if (free.ok) {
+          saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined });
+          host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${free.label}".` });
+          continue;
+        }
+        if (!/code required/i.test(free.error ?? "")) {
+          await showInfo(host.ui, { title: "Enrollment refused", message: free.error ?? "unknown error" });
+          continue;
+        }
+        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
         if (typed === undefined)
           continue;
         code = typed.trim();
@@ -1240,13 +1500,41 @@ Needs the server's root CREATE_TOKEN (saved admin token used first; prompted oth
       }
       const res = await enrollAtServer(url, code);
       if (res.ok) {
-        saveServerEntry(url, { token: res.token, label: res.label });
+        saveServerEntry(url, { token: res.token, label: res.label, anonymous: undefined });
         host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${res.label}".` });
       } else {
         await showInfo(host.ui, { title: "Enrollment refused", message: res.error ?? "unknown error" });
       }
       continue;
     }
+    if (choice === "account") {
+      const me = meClient(url, mine.entry.token ?? "");
+      const [meRes, sharesRes] = await Promise.all([me.me(), me.myShares()]);
+      if (!meRes.ok) {
+        await showInfo(host.ui, { title: "Account", message: `Could not read your account: ${meRes.error ?? "error"}.
+If the token was revoked server-side, use Enroll now instead.` });
+        continue;
+      }
+      const d = meRes.data;
+      const lim = d.token?.limits ?? {};
+      const fmt = (v) => v ? String(v) : "unlimited";
+      const lines = [
+        `User: ${d.label} (${d.userId})`,
+        `Token: ${d.token?.label ?? "?"} - expires ${d.token?.expiresAt ? new Date(d.token.expiresAt).toISOString().slice(0, 10) : "never"}`,
+        `Limits: live shares ${fmt(lim.maxLiveShares)} - max TTL ${fmt(lim.maxTtlDays)}d - daily creates ${fmt(lim.dailyCreates)}`
+      ];
+      if (sharesRes.ok) {
+        const shares = sharesRes.data?.shares ?? [];
+        lines.push(`Shares: ${shares.length} (${shares.filter((s) => s.status === "live").length} live)`);
+        for (const s of shares.slice(0, 10))
+          lines.push(`  ${s.id} - ${s.status} - ${new Date(s.createdAt).toISOString().slice(0, 10)}`);
+        if (shares.length > 10)
+          lines.push(`  ...and ${shares.length - 10} more`);
+      }
+      await showInfo(host.ui, { title: "Your account", message: lines.join(`
+`) });
+      continue;
+    }
     if (choice === "rotate") {
       const res = await rotateAtServer(url, mine.entry.token ?? "");
       if (res.ok && res.token) {
@@ -1258,8 +1546,13 @@ Needs the server's root CREATE_TOKEN (saved admin token used first; prompted oth
       continue;
     }
     if (choice === "disconnect") {
-      const sure = await showConfirm(host.ui, { title: "Disconnect", message: `Revoke the token at ${url} and forget it?
-Your shares stay (read-only for you until TTL).`, confirmLabel: "Disconnect", danger: true });
+      const sure = await showConfirm(host.ui, {
+        title: "Disconnect",
+        message: `Revoke the token at ${url} and forget it?
+Revoking your last token freezes control of ALL your shares there (even with the share secrets) - pages stay readable until their TTL; only the server admin can restore control.`,
+        confirmLabel: "Disconnect",
+        danger: true
+      });
       if (!sure)
         continue;
       const res = await disconnectAtServer(url, mine.entry.token ?? "");
@@ -1672,7 +1965,7 @@ async function adminSharesMenu(host, client, url, shares, users) {
     }
   }
 }
-async function settingsDialog(host, startAtSession) {
+async function settingsDialog(host, startAtSession, startGroup) {
   let cfg = currentConfig();
   let dirty = false;
   const candidates = writeCandidates(moduleDir());
@@ -1854,19 +2147,32 @@ ${otherServers.map((s) => `\u2022 ${s.url}`).join(`
       }
     }
     const binding = bindings[0];
+    if (binding?.lastError || binding?.ttlClamped) {
+      const bits = [];
+      if (binding?.ttlClamped)
+        bits.push(`TTL clamped ${binding.ttlClamped.requested}d -> ${binding.ttlClamped.effective}d by server/token policy`);
+      if (binding?.lastError)
+        bits.push(`last share error: ${binding.lastError}`);
+      rows.push({ title: "Share status notes", value: "__notes", description: bits[0].slice(0, 60), disabled: true, help: `Engine-recorded notes for this session's share(s):
+
+${bits.join(`
+`)}
+
+The clamp note appears when the server or your token's policy reduced a requested TTL. The error note is the engine's last create/attach refusal (quota, freeze, rate limit) - it clears on the next successful sync.` });
+    }
     rows.push({
       title: "Session TTL override (days)",
       value: "session:ttl",
-      description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-      help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. Applied at the next create/attach.
+      description: binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(worker default)",
+      help: `Per-session share lifetime in HOURS (prompt accepts 6h / 2d / 48). Overrides the config TTL for THIS session's pages; still capped server-side. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.
 
-Current: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none \u2014 config default)"}`
+Current: ${binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(none \u2014 config default)"}`
     });
     rows.push({
       title: "Session read auth",
       value: "session:auth",
       description: binding?.opts?.authLogin ? `${binding.opts.authLogin} / ****` : "(config default)",
-      help: `Login gate for THIS session's page only \u2014 viewers must log in (7-day cookie, lockout). Overrides the config read auth. Applied at the next create/attach; removing the login removes the gate.
+      help: `Login gate for THIS session's page only \u2014 viewers must log in (7-day cookie, lockout). Overrides the config read auth; a login and password are both required (or neither). On a live share it applies immediately; otherwise when you share. Removing the login removes the gate.
 
 Current: ${binding?.opts?.authLogin ? `${binding.opts.authLogin} / (password set)` : "(none \u2014 config default applies)"}`
     });
@@ -2049,11 +2355,9 @@ Note: no token held \u2014 the plugin enrolls on first contact (public) or needs
         });
         if (!pick || pick === "__cancel")
           return;
-        for (const s of serverEntries())
-          if (s.url !== pick)
-            saveServerEntry(s.url, { active: undefined });
         saveServerEntry(pick, { active: true });
-        host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated \u2014 this session mirrors there within seconds.` });
+        const nActive = serverEntries().filter((s) => s.active).length;
+        host.ui.toast({ variant: "success", title: "OpenShare", message: `${hostOf(pick)} activated (${nActive} active) - this session mirrors there within seconds.` });
         return;
       }
       if (choice === "session:unshare") {
@@ -2068,61 +2372,89 @@ Note: no token held \u2014 the plugin enrolls on first contact (public) or needs
         if (how === undefined || how === "__cancel")
           return;
         if (how === "leave") {
-          const all = await readBindings(host.client, root);
+          const allB = await readBindings(host.client, root);
           const okPatch = await patchSessionBinding(host.client, root, (servers) => {
-            for (const b of all) {
+            for (const b of allB) {
               if (!b.server)
                 continue;
-              delete servers[b.server];
-              servers[b.server] = { optedOut: true };
+              servers[b.server] = { ...servers[b.server], id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true };
             }
           });
-          host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is \u2014 snapshots until their TTLs." : "Could not update the binding." });
+          host.ui.toast({ variant: okPatch ? "success" : "error", title: "OpenShare", message: okPatch ? "Left as-is \u2014 snapshots until their TTLs (delete stays available here)." : "Could not update the binding." });
           return;
         }
+        const sureAll = await showConfirm(host.ui, {
+          title: "Delete every page?",
+          message: `Permanently delete ${live.length} share page(s) and stop sharing?
+Every link stops working for everyone. This cannot be undone.`,
+          confirmLabel: "Delete every page",
+          danger: true
+        });
+        if (!sureAll)
+          return;
         const result = await runUnshareFlow(host, startAtSession);
         host.ui.toast({ variant: result.ok ? "success" : "error", title: "OpenShare", message: result.message });
         return;
       }
       if (choice === "session:ttl") {
-        const raw = await showPrompt(host.ui, { title: "Session TTL (days)", placeholder: "days", value: current?.opts?.ttlDays !== undefined ? String(current.opts.ttlDays) : "" });
+        const raw = await showPrompt(host.ui, { title: "Session TTL", placeholder: "hours: 6h, 2d or 48", value: current?.opts?.ttlHours !== undefined ? fmtHours(current.opts.ttlHours) : "" });
         if (raw === undefined)
           return;
         const opts = { ...current?.opts ?? {} };
         if (raw === "")
-          delete opts.ttlDays;
+          delete opts.ttlHours;
         else {
-          const days = Number(raw);
-          if (!Number.isFinite(days) || days <= 0) {
-            host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be a positive number of days." });
+          const hours = parseTtlHours(raw);
+          if (hours === undefined) {
+            host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be 6h / 2d style or a positive number of hours." });
             return;
           }
-          opts.ttlDays = Math.floor(days);
+          opts.ttlHours = hours;
         }
-        await setShareFlag(host.client, root, opts);
-        host.ui.toast({ variant: "success", title: "OpenShare", message: opts.ttlDays !== undefined ? `Session TTL: ${opts.ttlDays}d (applies at the next attach/create)` : "Session TTL override cleared" });
+        await setShareOpts(host.client, root, opts);
+        const liveNow = live.length > 0;
+        if (liveNow) {
+          const results = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, opts.ttlHours !== undefined ? { ttlHours: opts.ttlHours } : {}, b.secret) : Promise.resolve({ ok: false })));
+          const failed = results.filter((r) => !r.ok).length;
+          if (failed)
+            host.ui.toast({ variant: "error", title: "OpenShare", message: `TTL applied on ${results.length - failed}/${results.length} server(s) - the rest sync on next connect.` });
+        }
+        host.ui.toast({
+          variant: "success",
+          title: "OpenShare",
+          message: liveNow ? `Session TTL: ${opts.ttlHours !== undefined ? `${fmtHours(opts.ttlHours)} - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.` : `Session TTL: ${opts.ttlHours !== undefined ? fmtHours(opts.ttlHours) : "(default)"} - saved, applies when you share.`
+        });
         return;
       }
       if (choice === "session:auth") {
-        const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = use config default", value: current?.opts?.authLogin ?? "" });
+        const login = await showPrompt(host.ui, { title: "Session read auth: login", placeholder: "empty = no read auth", value: current?.opts?.authLogin ?? "" });
         if (login === undefined)
           return;
-        const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: "empty = no password" });
+        const password = await showPrompt(host.ui, { title: "Session read auth: password", placeholder: login === "" ? "(unused)" : "password (required with a login)" });
         if (password === undefined)
           return;
+        if (login === "" !== (password === "")) {
+          host.ui.toast({ variant: "error", title: "OpenShare", message: "Read auth needs both a login and a password - or neither (no gate)." });
+          return;
+        }
         const opts = { ...current?.opts ?? {} };
         if (login === "") {
           delete opts.authLogin;
           delete opts.authPassword;
         } else {
           opts.authLogin = login;
-          if (password !== "")
-            opts.authPassword = password;
-          else
-            delete opts.authPassword;
+          opts.authPassword = password;
+        }
+        await setShareOpts(host.client, root, opts);
+        const liveNow2 = live.length > 0;
+        if (liveNow2) {
+          const pair = login === "" ? { authLogin: "", authPassword: "" } : { authLogin: login, authPassword: password };
+          const results2 = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, pair, b.secret) : Promise.resolve({ ok: false })));
+          const failed2 = results2.filter((r) => !r.ok).length;
+          if (failed2)
+            host.ui.toast({ variant: "error", title: "OpenShare", message: `Read auth applied on ${results2.length - failed2}/${results2.length} server(s) - the rest sync on next connect.` });
         }
-        await setShareFlag(host.client, root, opts);
-        host.ui.toast({ variant: "success", title: "OpenShare", message: "Session read auth saved (applies at the next attach/create)." });
+        host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` });
         return;
       }
     }
@@ -2139,6 +2471,8 @@ Note: no token held \u2014 the plugin enrolls on first contact (public) or needs
       await dispatch(choice);
     }
   };
+  if (startAtSession && startGroup === "session")
+    await groupMenu("session");
   const seconds = (ms, fallback) => `${Math.round((ms ?? fallback) / 100) / 10}s`;
   while (true) {
     const servers = serverEntries(cfg);
@@ -2170,7 +2504,7 @@ Every ACTIVE server receives new sessions (fan-out).`
     });
     groups.push({
       id: "sharing",
-      summary: `sync ${seconds(cfg.debounceMs, 1e4)} \xB7 completed ${seconds(cfg.completedDelayMs, 5000)} \xB7 TTL ${cfg.ttlDays ?? "server cap"}`,
+      summary: `sync ${seconds(cfg.debounceMs, 1e4)} \xB7 completed ${seconds(cfg.completedDelayMs, 5000)} \xB7 TTL ${fmtHours(cfg.ttlHours ?? 2160)}`,
       help: `What and how sessions stream: share mode (all/manual), sync cadence, the completed-delay, the model label on pages, share TTL, and the viewer's task-tab behavior.
 
 Cadence values are clamped by the server's policy window.`
@@ -2363,7 +2697,7 @@ function buildShareCommand(host, sessionID) {
       dbgLog(`/share run: entered (sid=${sessionID() ?? "none"})`);
       host.ui.dialog.clear();
       const cfg = currentConfig();
-      if (!isConfigured(cfg)) {
+      if (!isConfigured(cfg) && !engineTargetUrls().length) {
         onboardingDialog(host);
         return;
       }
@@ -2378,7 +2712,7 @@ function buildShareCommand(host, sessionID) {
         return;
       const { all, goneShown } = swept;
       if (all.some((b) => b.url && b.enabled !== false)) {
-        await settingsDialog(host, sid);
+        await settingsDialog(host, sid, "session");
         return;
       }
       if (goneShown && all.length === 0)