@mirrowel/opencode-openshare 0.2.1 → 0.3.0-dev.1

package/src/dialogs.tsx

@@ -163,11 +163,11 @@ function estimatedVisualRows(message: string, width: number) {
   return message.split(/\r?\n/).reduce((rows, line) => rows + Math.max(1, Math.ceil(line.length / Math.max(1, width))), 0)
 }
 
-/** Deterministic character-level pre-wrap (parity lesson: opentui's
- * word wrap cannot break unbreakable tokens like a JSON policy blob, so
- * "wrapped" text still escaped the dialog border — live-caught). Both the
- * [i] pane and InfoDialog render THESE lines; the row estimate uses the
- * same output, so heights match what renders. */
+/** Deterministic character-level pre-wrap: opentui's word wrap cannot
+ * break unbreakable tokens like a JSON policy blob, so "wrapped" text still
+ * escapes the dialog border. Both the [i] pane and InfoDialog render THESE
+ * lines; the row estimate uses the same output, so heights match what
+ * renders. */
 export function preWrap(text: string, width: number): string[] {
   const out: string[] = []
   for (const raw of text.split(/\r?\n/)) {
@@ -229,10 +229,9 @@ function InfoLines(props: { api: TuiPluginApi; lines: string[] }): JSX.Element {
   )
 }
 
-/** title column cap (family menuTitleWidth, live-caught need: a server URL
- * as a row title stretched the column toward half the dialog — the owner
- * capped it further: full URLs belong in the [i] pane, not the row).
- * Capped + ellipsized. */
+/** Title column cap (family menuTitleWidth): a server URL as a row title
+ * would otherwise stretch the column toward half the dialog. Full URLs
+ * belong in the [i] pane, not the row. Capped and ellipsized. */
 function menuTitleWidth(width: DialogWidth, options: readonly { title: string }[]) {
   const longest = Math.max(0, ...options.map((option) => option.title.length)) + 2
   if (width === "xlarge") return Math.min(Math.max(20, longest), 28)
@@ -246,13 +245,12 @@ function ellipsize(text: string, width: number) {
 
 /** OpenShare visual frame: rounded accent border + accent title row. The
  * logic inside the menus stays the ported family pattern; this wrapper is
- * purely presentation (owner-preferred styling). Natural width — the host
- * dialog panel provides the container; the border hugs the content. */
-// Frame note (live-caught): the HOST dialog panel renders plugin content
-// with paddingTop=1 (opencode dialog.tsx), so a BORDERED frame always
-// showed a dead panel strip above its top border. Borderless family
-// shape + a solid accent rule under the title: zero dead space, accent
-// identity kept.
+ * purely presentation. Natural width: the host dialog panel provides the
+ * container and the border hugs the content. */
+// Frame note: the HOST dialog panel renders plugin content with
+// paddingTop=1 (opencode dialog.tsx), so a BORDERED frame always shows a
+// dead panel strip above its top border. Borderless family shape plus a
+// solid accent rule under the title: zero dead space, accent identity kept.
 function DialogFrame(props: { api: TuiPluginApi; title: string; children: JSX.Element }): JSX.Element {
   const theme = () => props.api.theme.current
   return (
@@ -323,8 +321,8 @@ export function MenuDialog<Value>(props: {
   const dimensions = useTerminalDimensions()
   const listHeight = createMemo(() => cappedHeight(props.options.length, maxRows(props.api, dimensions().height, 12, 4), 4))
   // fixed title column shared by every row (family menuTitleWidth): flex
-  // columns stagger per-row because flex splits by content — a computed
-  // width is what makes the value/description column align (live-caught).
+  // columns stagger per row because flex splits by content, so a computed
+  // width is what makes the value/description column align.
   const width = dialogWidthOf(props.api)
   const titleWidth = createMemo(() => menuTitleWidth(width, props.options))
   const hasHelp = createMemo(() => props.options.some((option) => option.help))
@@ -352,8 +350,8 @@ export function MenuDialog<Value>(props: {
     })
   // [i] pane sections: "## Header" lines in help split sections; the pane
   // height comes from the CONTENT (pre-wrapped rows), capped by the same
-  // dialog metrics — no longer bound to the spawning menu's list height
-  // (live-caught: a 3-row menu gave a 3-row info pane).
+  // dialog metrics rather than the spawning menu's list height (which gave
+  // a 3-row menu a 3-row info pane).
   const helpSections = createMemo(() => {
     const raw = current()?.help ?? ""
     const sections: Array<{ title: string; lines: string[] }> = [{ title: "", lines: [] }]
@@ -602,11 +600,10 @@ function claimDialog(api: TuiPluginApi): () => void {
   pendingDialog = release
   return release
 }
-/** showMenuOnce, family discipline with the flicker fix (2026-10-19):
- * done() does NOT clear the host stack — the next dialog's replace() is an
- * atomic swap, so clearing first paints one empty frame (the esc-to-parent
- * flicker, live-caught). Chain ends clear explicitly (command exits,
- * settings exit). */
+/** showMenuOnce, family discipline: done() does NOT clear the host stack,
+ * because the next dialog's replace() is an atomic swap and clearing first
+ * paints one empty frame (the esc-to-parent flicker). Chain ends clear
+ * explicitly (command exits, settings exit). */
 export function showMenuOnce<Value>(api: TuiPluginApi, props: { title: string; options: MenuOption<Value>[]; current?: Value; hint?: string }): Promise<Value | undefined> {
   return new Promise((resolve) => {
     let settled = false
@@ -627,11 +624,11 @@ export function showMenuOnce<Value>(api: TuiPluginApi, props: { title: string; o
 }
 
 // --- InfoDialog (config-studio port): a real message body ----------------------
-// Content-derived height, pre-wrapped (char-level — word wrap cannot break
+// Content-derived height, pre-wrapped (char-level: word wrap cannot break
 // JSON blobs), semantically styled lines, page/home/end keys, and an action
-// footer with buttons + key shortcuts. Replaces the hint-as-message menus
-// for confirm/alert (whose single overflow-hidden line clipped destructive
-// prompts mid-URL — live-caught).
+// footer with buttons + key shortcuts. Replaces the hint-as-message menus for
+// confirm/alert, whose single overflow-hidden line clipped destructive
+// prompts mid-URL.
 
 export type DialogAction = { title: string; value: string; key?: string; danger?: boolean }
 
@@ -772,9 +769,9 @@ export function showAlertMenu(api: TuiPluginApi, props: { title: string; message
 
 // --- prompt (text entry — the one custom piece) -------------------------------
 
-// Full printable ASCII (parity fix, live-caught class: the lowercase-only
-// set made uppercase CREATE_TOKENs and codes UNTYPEABLE). Space is bound
-// separately below; escape is the back binding, so it's excluded.
+// Full printable ASCII: a lowercase-only set makes uppercase
+// CREATE_TOKENs and codes UNTYPEABLE. Space is bound separately below;
+// escape is the back binding, so it is excluded.
 const PROMPT_CHARS = [
   ..."abcdefghijklmnopqrstuvwxyz",
   ..."ABCDEFGHIJKLMNOPQRSTUVWXYZ",

package/src/redact.ts

@@ -0,0 +1,134 @@
+/**
+ * Client-only redaction + light path transform (Wave 3 trust).
+ *
+ * Owner verdict: the server stays dumb - the client controls what leaves
+ * the machine. This pass runs once at enqueue (the single choke point
+ * every item crosses before any transport) on UNGATED shares only: a
+ * share with login+pass is private from casual observers already, and
+ * redacting there would corrupt content the server owner can see anyway
+ * (documented caveat: NOT private from the server owner until Wave 3b
+ * encryption lands).
+ *
+ * Extending: add a detector to BUILTINS (fork-friendly registry) or set
+ * `redact.patterns` in the config (regex source strings, global flag).
+ */
+
+/** A detector: stable `kind` names the marker, e.g. `[redacted:aws-key]`. */
+export type RedactRule = { kind: string; re: RegExp }
+
+export const BUILTINS: RedactRule[] = [
+  { kind: "aws-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { kind: "gh-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { kind: "gh-token", re: /\bgithub_pat_[A-Za-z0-9_]{22,255}\b/g },
+  { kind: "api-key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: "google-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "bearer", re: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  // PEM private-key blocks (whole block)
+  { kind: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+  // .env style assignments for secret-shaped names
+  { kind: "env-secret", re: /(?<![A-Za-z0-9_])(?:export\s+)?[A-Z0-9_]*(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?)[A-Z0-9_]*\s*=\s*\S+/g },
+  // URL connection strings with embedded passwords (password masked)
+  { kind: "conn-string", re: /\b[a-z][a-z0-9+.-]*:\/\/[^:@/\s"']+:[^@/\s"']{4,}@/gi },
+]
+
+/** Config-supplied rules (regex source strings, applied globally). */
+function compile(patterns: unknown): RedactRule[] {
+  if (!Array.isArray(patterns)) return []
+  const out: RedactRule[] = []
+  for (const p of patterns) {
+    if (typeof p !== "string" || !p) continue
+    try {
+      out.push({ kind: "user", re: new RegExp(p, "g") })
+    } catch {
+      // a broken user regex must never kill sharing - skip it
+    }
+  }
+  return out
+}
+
+export type RedactionHit = { kind: string; sample: string }
+
+/** Home-directory prefix -> `~`; applied consistently to session.directory
+ * AND tool path fields so viewer-side relativization still works (both
+ * ends share the ~-prefixed form). */
+export function tildePath(p: string, home: string): string {
+  if (!p || !home || p.length <= home.length) return p
+  const norm = (s: string) => s.replace(/[\\/]+/g, "/").replace(/\/$/, "")
+  const np = norm(p)
+  const nh = norm(home)
+  if (np === nh) return "~"
+  if (np.startsWith(nh + "/")) return "~" + np.slice(nh.length)
+  return p
+}
+
+const PATH_KEYS = new Set(["file", "path", "filePath", "cwd", "directory", "root"])
+
+type Opts = { rules: RedactRule[]; home: string; enabled: boolean }
+type Stats = { hits: RedactionHit[]; changed: boolean }
+
+/**
+ * Apply redaction (when enabled) + the light path transform to one
+ * contract item. Returns the ORIGINAL untouched when nothing matched
+ * (zero-copy fast path for clean sessions); otherwise a mutated deep
+ * clone - the host's live object is never touched.
+ */
+export function redactItem(item: unknown, opts: Opts): { item: unknown; hits: RedactionHit[] } {
+  const flat = JSON.stringify(item) ?? "null"
+  const needRedact = opts.enabled && opts.rules.some((r) => { r.re.lastIndex = 0; return r.re.test(flat) })
+  const needPaths = !!opts.home && flat.includes(opts.home)
+  if (!needRedact && !needPaths) return { item, hits: [] }
+  const clone = JSON.parse(flat) as unknown
+  const stats: Stats = { hits: [], changed: false }
+  walk(clone, opts, stats)
+  return { item: clone, hits: stats.hits }
+}
+
+function walk(node: unknown, opts: Opts, stats: Stats, key?: string): void {
+  if (Array.isArray(node)) {
+    for (let i = 0; i < node.length; i++) {
+      const v = node[i]
+      if (typeof v === "string") node[i] = applyString(v, opts, stats, key)
+      else walk(v, opts, stats, key)
+    }
+    return
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node as Record<string, unknown>)) {
+      if (typeof v === "string") (node as Record<string, unknown>)[k] = applyString(v, opts, stats, k)
+      else walk(v, opts, stats, k)
+    }
+  }
+}
+
+function applyString(v: string, opts: Opts, stats: Stats, key?: string): string {
+  let out = v
+  if (opts.enabled) {
+    for (const r of opts.rules) {
+      r.re.lastIndex = 0
+      out = out.replace(r.re, (full) => {
+        if (stats.hits.length < 8 && !stats.hits.some((h) => h.kind === r.kind)) {
+          stats.hits.push({ kind: r.kind, sample: full.slice(0, 60) })
+        }
+        stats.changed = true
+        if (r.kind === "conn-string") {
+          // keep scheme://user, mask the password, keep @host
+          const at = full.lastIndexOf("@")
+          const colon = full.indexOf(":", full.indexOf("://") + 3) + 1
+          if (at > colon && colon > 0) return full.slice(0, colon) + "[redacted:conn-string]" + full.slice(at)
+        }
+        return `[redacted:${r.kind}]`
+      })
+    }
+  }
+  if (key && PATH_KEYS.has(key) && opts.home && out.includes(opts.home)) {
+    out = tildePath(out, opts.home)
+    stats.changed = true
+  }
+  return out
+}
+
+/** All active rules (built-ins + compiled user patterns). */
+export function activeRules(userPatterns: unknown): RedactRule[] {
+  return [...BUILTINS, ...compile(userPatterns)]
+}

package/src/settings.ts

@@ -15,12 +15,15 @@ import {
   deleteServerEntry,
   disconnectAtServer,
   enrollAtServer,
+  fmtHours,
+  parseTtlHours,
   hostOf,
   isConfigured,
   normServerUrl,
   probeAuthMode,
   probeWorker,
   patchSessionBinding,
+  patchShareOpts,
   readBinding,
   readBindings,
   resolveRoot,
@@ -146,13 +149,13 @@ const LABELS: Record<string, LabelMeta> = {
     info: 'How the model name appears on the share page. "$Provider/$Model" renders e.g. "closedrouter/zai/glm-5.3". Any literal text is used as-is; empty string hides the model line entirely.',
     def: '"$Provider/$Model"',
   },
-  ttlDays: {
-    label: "TTL (days)",
-    help: "Share lifetime; the worker caps it at its MAX_TTL_DAYS.",
+  ttlHours: {
+    label: "TTL (hours)",
+    help: "Share lifetime in hours (2d writes 48); capped server-side.",
     kind: "number",
     section: "Sharing",
-    info: "How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.\n\nA per-session override lives in the This-session section; it is sent at create/attach time.",
-    def: "worker cap (90 on the reference deployment)",
+    info: "How long pages live before the server's sweeper deletes them, in HOURS. Capped server-side: the deployment's MAX_TTL_HOURS (legacy MAX_TTL_DAYS converted) and the token's limit both apply; the floor is one hour.\n\nA per-session override lives in the This-session section; it is sent at create/attach time. The session prompt takes 6h / 2d style input.",
+    def: "worker cap (2160h = 90d on the reference deployment)",
   },
   authLogin: {
     label: "Read auth: login",
@@ -219,8 +222,8 @@ function displayValue(key: string, cfg: ShareConfig): string {
 async function editKey(host: ShareHostApi, cfg: ShareConfig, key: string): Promise<ShareConfig | undefined> {
   const meta = LABELS[key]
   if (!meta) return undefined
-  // selection-backed settings (owner: "setting share mode i need to enter it
-  // manually? No selection?") — fixed vocabularies become menus
+  // selection-backed settings: fixed vocabularies become menus instead of
+  // asking for a typed value
   if (meta.options) {
     const current = String((cfg as unknown as Record<string, unknown>)[key] ?? "")
     const picked = await showSelect(host.ui, {
@@ -262,39 +265,91 @@ async function editKey(host: ShareHostApi, cfg: ShareConfig, key: string): Promi
   return next as ShareConfig
 }
 
-/** Connect (add + enroll) a server — the /share first-run flow and the
+/** Connect (add + enroll) a server - the /share first-run flow and the
  * settings "Connect to a server" row share it. Prompts the URL, probes
- * the auth mode, prompts a code for private servers, enrolls, persists
- * the token and makes it the active server. */
+ * the auth mode, then ASKS ONCE: onboard to an account, or stay anonymous
+ * (public servers only; anonymous shares sit under the server's global
+ * caps). Onboarding detects whether a code is needed and only then prompts
+ * for one (a code already in config is used without asking). The outcome is
+ * remembered per server: a token means onboarded, an anonymous flag means
+ * declined. */
 export async function connectServerFlow(host: ShareHostApi): Promise<{ ok: boolean; message: string; url?: string }> {
   const raw = await showPrompt(host.ui, { title: "Share server URL", placeholder: "https://your-openshare-host" })
   if (raw === undefined || raw === "") return { ok: false, message: "Cancelled." }
   const url = normServerUrl(raw)
   if (!/^https?:\/\//.test(url)) return { ok: false, message: "URL must start with http:// or https://" }
-  host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}…` })
+  host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}:` })
   const probe = await probeAuthMode(url)
   if (!probe.ok) return { ok: false, message: `${url}: ${probe.detail}` }
-  let code = ""
-  if (probe.mode === "private") {
-    const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" })
-    if (typed === undefined) return { ok: false, message: "Cancelled — private servers need a code." }
+  const existing = serverEntries().find((sv) => sv.url === url)?.entry ?? {}
+  const deactivateOthers = () => {
+    for (const other of serverEntries()) {
+      if (other.url !== url) saveServerEntry(other.url, { active: undefined })
+    }
+  }
+  if (probe.mode === "public") {
+    // the ask: an account is a real thing (own shares, own limits,
+    // revocable credentials) - but anonymous sharing works too
+    const picked = await showSelect(host.ui, {
+      title: `${url} - account?`,
+      options: [
+        {
+          value: "onboard",
+          title: "Onboard (get an account)",
+          description: "your own user, tokens and share limits; survives the server's anonymous caps",
+          help: "An account gives you a revocable identity with your own share registry and limits. Depending on the server you may need a one-time access code from the hoster - you'll be asked only if it's required.",
+        },
+        {
+          value: "anon",
+          title: "Stay anonymous",
+          description: "share without an account; counts against the server-wide anonymous limits",
+          help: "No identity, no token to manage. Shares are ownerless: whoever holds the share's secret controls them, and the server may throttle anonymous creates globally. You can onboard later from Servers -> the server -> Enroll now.",
+        },
+      ],
+    })
+    if (picked === "anon") {
+      saveServerEntry(url, { ...(existing.token ? {} : { anonymous: true }), label: existing.label, active: true })
+      return { ok: true, message: `Connected to ${url} anonymously - sharing works, no account.`, url }
+    }
+    if (picked === undefined || picked === null) return { ok: false, message: "Cancelled." }
+    // onboard: try without a code (codeless servers), fall through to
+    // the code prompt exactly when the server demands one
+    let code = existing.code ?? ""
+    if (!code) {
+      const free = await enrollAtServer(url, "")
+      if (free.ok) {
+        deactivateOthers()
+        saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined, active: true })
+        return { ok: true, message: `Connected to ${url} as "${free.label}" - sharing goes there now.`, url }
+      }
+      const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" })
+      if (typed === undefined) return { ok: false, message: "Cancelled - this server needs a code to onboard." }
+      code = typed.trim()
+    }
+    const res = await enrollAtServer(url, code)
+    if (!res.ok) return { ok: false, message: `Enrollment refused: ${res.error}` }
+    deactivateOthers()
+    saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, anonymous: undefined, active: true })
+    return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url }
+  }
+  // private server: a code is required, full stop
+  let code = existing.code ?? ""
+  if (!code) {
+    const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" })
+    if (typed === undefined) return { ok: false, message: "Cancelled - private servers need a code." }
     code = typed.trim()
   }
   const res = await enrollAtServer(url, code)
   if (!res.ok) return { ok: false, message: `Enrollment refused: ${res.error}` }
-  // single active server: deactivate the others in the settings home,
-  // then persist the new membership as active
-  for (const other of serverEntries()) {
-    if (other.url !== url) saveServerEntry(other.url, { active: undefined })
-  }
+  deactivateOthers()
   saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, active: true })
-  return { ok: true, message: `Connected to ${url} as "${res.label}" — sharing goes there now.`, url }
+  return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url }
 }
 
 /** Per-server submenu: identity status + membership actions. Root-token
- * holders get "Get a user token" (admin mints their own user identity —
- * root stays as adminToken; being admin and being a user are NOT mutually
- * exclusive, live-caught). */
+ * holders get "Get a user token" (the admin mints their own user identity;
+ * root stays as adminToken, since being admin and being a user are not
+ * mutually exclusive). */
 async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
   while (true) {
     const entries = serverEntries()
@@ -307,7 +362,9 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
         ? `token ${mask(mine.entry.token)}`
         : mine.entry.code
           ? "no token (code saved, enrolls on demand)"
-          : "no token (public server, enrolls on demand)"
+          : mine.entry.anonymous
+            ? "anonymous (declined onboarding)"
+            : "no token (public server, shares anonymously)"
     const options: ShareDialogSelectOption<string>[] = [
       { title: url, value: "info", description: `${mine.entry.label ?? "(no label)"} · ${cred}${mine.active ? " · ACTIVE" : ""}`, disabled: true },
     ]
@@ -381,15 +438,27 @@ async function serverMenu(host: ShareHostApi, url: string): Promise<void> {
         continue
       }
       let code = mine.entry.code ?? ""
-      if (probe.mode === "private" && !code) {
-        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" })
+      if (!code) {
+        // codeless first: only prompt when the server actually demands
+        // a code (public + codeless-on boards silently, like connect)
+        const free = await enrollAtServer(url, "")
+        if (free.ok) {
+          saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined })
+          host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${free.label}".` })
+          continue
+        }
+        if (!/code required/i.test(free.error ?? "")) {
+          await showInfo(host.ui, { title: "Enrollment refused", message: free.error ?? "unknown error" })
+          continue
+        }
+        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" })
         if (typed === undefined) continue
         code = typed.trim()
         if (code) saveServerEntry(url, { code })
       }
       const res = await enrollAtServer(url, code)
       if (res.ok) {
-        saveServerEntry(url, { token: res.token, label: res.label })
+        saveServerEntry(url, { token: res.token, label: res.label, anonymous: undefined })
         host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${res.label}".` })
       } else {
         await showInfo(host.ui, { title: "Enrollment refused", message: res.error ?? "unknown error" })
@@ -599,9 +668,9 @@ async function withBusy(host: ShareHostApi, title: string, work: Promise<void> |
   doneBusy?.()
 }
 
-/** Server info, the readable version (live-caught: the raw JSON policy line
- * escaped the dialog border): formatted policy lines, auth explained in
- * words, YOUR standing on this server, and follow-up actions. */
+/** Server info, the readable version (the raw JSON policy line escapes
+ * the dialog border): formatted policy lines, auth explained in words,
+ * YOUR standing on this server, and follow-up actions. */
 async function serverInfoScreen(host: ShareHostApi, url: string, client: ReturnType<typeof adminClient>): Promise<void> {
   const h = await client.health()
   if (!h.ok) {
@@ -844,16 +913,15 @@ async function adminSharesMenu(host: ShareHostApi, client: ReturnType<typeof adm
 }
 
 /** The settings dialog: a compact ROOT of group entries (with live
- * summaries) opening focused submenus. Two-level by design — one flat
- * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
- * Save semantics unchanged: root Exit saves when dirty; submenu Back
- * just returns. */
+ * summaries) opening focused submenus. Two-level by design: one flat ~25-row
+ * dump is unreadable. Save semantics unchanged: root Exit saves when dirty;
+ * submenu Back just returns. */
 export async function settingsDialog(host: ShareHostApi, startAtSession?: string, startGroup?: "session"): Promise<void> {
   let cfg = currentConfig()
   let dirty = false
-  // Write target (owner rule): global settings home by default; any other
-  // existing file in the read chain may be chosen explicitly. The TUI
-  // never creates deploy-time override files.
+  // Write target: global settings home by default; any other existing
+  // file in the read chain may be chosen explicitly. The TUI never
+  // creates deploy-time override files.
   const candidates = writeCandidates(moduleDir())
   let writeTarget: WriteCandidate = candidates[0]
   const sources = configSourceMap(moduleDir())
@@ -1017,8 +1085,8 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
     rows.push({
       title: "Session TTL override (days)",
       value: "session:ttl",
-      description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-      help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
+      description: binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(worker default)",
+      help: `Per-session share lifetime in HOURS (prompt accepts 6h / 2d / 48). Overrides the config TTL for THIS session's pages; still capped server-side. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(none — config default)"}`,
     })
     rows.push({
       title: "Session read auth",
@@ -1233,9 +1301,9 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
             for (const b of allB) {
               if (!b.server) continue
               // keep id/secret on the opt-out marker: the snapshot stays
-              // deletable later and re-sharing reuses the binding instead
-              // of stalling on a secret-less marker (live-caught as "can
-              // never unshare or re-share after leave-as-is")
+              // deletable later, and re-sharing reuses the binding instead
+              // of stalling on a secret-less marker that can never unshare
+              // or re-share again.
               servers[b.server] = { ...(servers[b.server] as Record<string, unknown> | undefined), id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true }
             }
           })
@@ -1254,26 +1322,32 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
         return
       }
       if (choice === "session:ttl") {
-        const raw = await showPrompt(host.ui, { title: "Session TTL (days)", placeholder: "days", value: current?.opts?.ttlDays !== undefined ? String(current.opts.ttlDays) : "" })
+        const raw = await showPrompt(host.ui, { title: "Session TTL", placeholder: "hours: 6h, 2d or 48", value: current?.opts?.ttlHours !== undefined ? fmtHours(current.opts.ttlHours) : "" })
         if (raw === undefined) return
         const opts: SessionOpts = { ...(current?.opts ?? {}) }
-        if (raw === "") delete opts.ttlDays
+        if (raw === "") delete opts.ttlHours
         else {
-          const days = Number(raw)
-          if (!Number.isFinite(days) || days <= 0) {
-            host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be a positive number of days." })
+          const hours = parseTtlHours(raw)
+          if (hours === undefined) {
+            host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be 6h / 2d style or a positive number of hours." })
             return
           }
-          opts.ttlDays = Math.floor(days)
+          opts.ttlHours = hours
         }
         await setShareOpts(host.client, root, opts)
         const liveNow = live.length > 0
+        if (liveNow) {
+          // REST push (#13): immediate on every server, socket or not
+          const results = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, opts.ttlHours !== undefined ? { ttlHours: opts.ttlHours } : {}, b.secret) : Promise.resolve({ ok: false })))
+          const failed = results.filter((r) => !r.ok).length
+          if (failed) host.ui.toast({ variant: "error", title: "OpenShare", message: `TTL applied on ${results.length - failed}/${results.length} server(s) - the rest sync on next connect.` })
+        }
         host.ui.toast({
           variant: "success",
           title: "OpenShare",
           message: liveNow
-            ? `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
-            : `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d` : "(default)"} - saved, applies when you share.`,
+            ? `Session TTL: ${opts.ttlHours !== undefined ? `${fmtHours(opts.ttlHours)} - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
+            : `Session TTL: ${opts.ttlHours !== undefined ? fmtHours(opts.ttlHours) : "(default)"} - saved, applies when you share.`,
         })
         return
       }
@@ -1298,6 +1372,12 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
         }
         await setShareOpts(host.client, root, opts)
         const liveNow2 = live.length > 0
+        if (liveNow2) {
+          const pair = login === "" ? { authLogin: "", authPassword: "" } : { authLogin: login, authPassword: password }
+          const results2 = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, pair, b.secret) : Promise.resolve({ ok: false })))
+          const failed2 = results2.filter((r) => !r.ok).length
+          if (failed2) host.ui.toast({ variant: "error", title: "OpenShare", message: `Read auth applied on ${results2.length - failed2}/${results2.length} server(s) - the rest sync on next connect.` })
+        }
         host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` })
         return
       }
@@ -1350,7 +1430,7 @@ export async function settingsDialog(host: ShareHostApi, startAtSession?: string
     })
     groups.push({
       id: "sharing",
-      summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${cfg.ttlDays ?? "server cap"}`,
+      summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${fmtHours(cfg.ttlHours ?? 2160)}`,
       help: `What and how sessions stream: share mode (all/manual), sync cadence, the completed-delay, the model label on pages, share TTL, and the viewer's task-tab behavior.\n\nCadence values are clamped by the server's policy window.`,
     })
     groups.push({