@mirrowel/opencode-openshare 0.2.1 → 0.3.0-dev.1

package/ci/openshare.js

@@ -35,11 +35,13 @@ var DEFAULTS = {
   debounceMs: 1e4,
   completedDelayMs: 5000,
   modelLabel: "$Provider/$Model",
-  ttlDays: 90,
+  ttlHours: 90 * 24,
   authLogin: "",
   authPassword: "",
   spoolDir: "",
   urlFile: "",
+  urlFileFormat: "url",
+  configSet: "",
   announceStderr: true
 };
 var CONFIG_NAME = "openshare.config.json";
@@ -78,6 +80,76 @@ function configPaths(pluginDir, env = process.env) {
 function configHomePath(env = process.env) {
   return join(globalConfigDir(env), CONFIG_NAME);
 }
+function configSourceMap(pluginDir, env = process.env) {
+  const emptyMeansUnset = new Set(["workerUrl", "createToken", "urlFile", "spoolDir"]);
+  const known = new Set([...Object.keys(DEFAULTS), "shareMode", "servers"]);
+  const sources = {};
+  const envKeys = {
+    workerUrl: env.OPENSHARE_WORKER_URL,
+    createToken: env.OPENSHARE_CREATE_TOKEN,
+    debounceMs: env.OPENSHARE_DEBOUNCE_MS,
+    completedDelayMs: env.OPENSHARE_COMPLETED_DELAY_MS,
+    modelLabel: env.OPENSHARE_MODEL_LABEL,
+    ttlHours: env.OPENSHARE_TTL_HOURS,
+    ttlDays: env.OPENSHARE_TTL_DAYS,
+    authLogin: env.OPENSHARE_AUTH_LOGIN,
+    authPassword: env.OPENSHARE_AUTH_PASSWORD,
+    urlFile: env.OPENSHARE_URL_FILE,
+    urlFileFormat: env.OPENSHARE_URL_FILE_FORMAT,
+    configSet: env.OPENSHARE_CONFIG_SET,
+    spoolDir: env.OPENSHARE_SPOOL_DIR,
+    announceStderr: env.OPENSHARE_ANNOUNCE_STDERR,
+    shareMode: env.OPENSHARE_SHARE_MODE
+  };
+  for (const [key, value] of Object.entries(envKeys)) {
+    if (value !== undefined && value !== "")
+      sources[key] = "environment";
+  }
+  if (sources.ttlDays && !sources.ttlHours)
+    sources.ttlHours = sources.ttlDays;
+  delete sources.ttlDays;
+  if (env.OPENSHARE_CONFIG_JSON) {
+    try {
+      const raw = JSON.parse(env.OPENSHARE_CONFIG_JSON);
+      if (raw && typeof raw === "object") {
+        for (const [key, value] of Object.entries(raw)) {
+          if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+            continue;
+          if (sources[key] === "environment")
+            continue;
+          if (key === "servers" || known.has(key))
+            sources[key] = "OPENSHARE_CONFIG_JSON";
+        }
+      }
+    } catch {}
+  }
+  for (const path of configPaths(pluginDir, env)) {
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(path, "utf8"));
+      if (!raw || typeof raw !== "object")
+        continue;
+    } catch {
+      continue;
+    }
+    const label = basename(path) === LOCAL_NAME ? `openshare.local.json (${dirname(path).split(/[\\/]/).pop()})` : `${basename(path)} (${dirname(path).split(/[\\/]/).pop()})`;
+    for (const [key, value] of Object.entries(raw)) {
+      if (key === "servers") {
+        if (sources.servers === undefined && normalizeServers(value))
+          sources.servers = label;
+        continue;
+      }
+      if (sources[key] !== undefined || !known.has(key))
+        continue;
+      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        continue;
+      if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
+        continue;
+      sources[key] = label;
+    }
+  }
+  return sources;
+}
 function num(value, fallback) {
   const parsed = Number(value);
   return Number.isFinite(parsed) ? parsed : fallback;
@@ -104,6 +176,8 @@ function normalizeServers(raw) {
       entry.adminToken = e.adminToken;
     if (e.active === true)
       entry.active = true;
+    if (e.anonymous === true)
+      entry.anonymous = true;
     out[url] = entry;
   }
   return Object.keys(out).length ? out : undefined;
@@ -155,26 +229,53 @@ function loadConfig(pluginDir, options) {
   const cfg = { ...DEFAULTS };
   const emptyMeansUnset = new Set(["workerUrl", "createToken", "urlFile", "spoolDir"]);
   const known = new Set([...Object.keys(DEFAULTS), "shareMode"]);
-  for (const path of [...configPaths(pluginDir)].reverse()) {
-    try {
-      const raw = JSON.parse(readFileSync(path, "utf8"));
-      if (!raw || typeof raw !== "object")
+  const applyObject = (raw) => {
+    if (!raw || typeof raw !== "object")
+      return;
+    for (const [key, value] of Object.entries(raw)) {
+      if (key === "servers") {
+        const servers = normalizeServers(value);
+        if (servers)
+          cfg.servers = mergeServerGroups(cfg.servers, servers);
         continue;
-      for (const [key, value] of Object.entries(raw)) {
-        if (key === "servers") {
-          const servers = normalizeServers(value);
-          if (servers)
-            cfg.servers = mergeServerGroups(cfg.servers, servers);
-          continue;
+      }
+      if (key === "redact") {
+        if (value && typeof value === "object" && Array.isArray(value.patterns)) {
+          const pats = value.patterns.filter((x) => typeof x === "string" && x.length > 0 && x.length < 500).slice(0, 50);
+          cfg.redact = { patterns: pats };
         }
-        if (!known.has(key))
-          continue;
-        if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
-          continue;
-        if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
-          continue;
-        cfg[key] = value;
+        continue;
+      }
+      if (key === "meta") {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          const clean = {};
+          for (const [mk, mv] of Object.entries(value)) {
+            if (typeof mv === "string" && mv.length <= 500 && mk.length <= 64)
+              clean[mk] = mv;
+          }
+          if (Object.keys(clean).length)
+            cfg.meta = { ...cfg.meta, ...clean };
+        }
+        continue;
+      }
+      if (key === "ttlDays") {
+        const d = Math.floor(Number(value));
+        if (Number.isFinite(d) && d > 0)
+          cfg.ttlHours = d * 24;
+        continue;
       }
+      if (!known.has(key))
+        continue;
+      if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        continue;
+      if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
+        continue;
+      cfg[key] = value;
+    }
+  };
+  for (const path of [...configPaths(pluginDir)].reverse()) {
+    try {
+      applyObject(JSON.parse(readFileSync(path, "utf8")));
     } catch (e) {
       if (existsSync(path))
         console.error(`[openshare] config file ${path} could not be parsed - ignored:`, e?.message ?? e);
@@ -197,6 +298,13 @@ function loadConfig(pluginDir, options) {
       cfg.shareMode = mode;
   }
   const env = process.env;
+  if (env.OPENSHARE_CONFIG_JSON) {
+    try {
+      applyObject(JSON.parse(env.OPENSHARE_CONFIG_JSON));
+    } catch (e) {
+      console.error("[openshare] OPENSHARE_CONFIG_JSON could not be parsed - ignored:", e?.message ?? e);
+    }
+  }
   if (env.OPENSHARE_WORKER_URL)
     cfg.workerUrl = env.OPENSHARE_WORKER_URL;
   if (env.OPENSHARE_CREATE_TOKEN)
@@ -207,14 +315,20 @@ function loadConfig(pluginDir, options) {
     cfg.completedDelayMs = num(env.OPENSHARE_COMPLETED_DELAY_MS, cfg.completedDelayMs);
   if (env.OPENSHARE_MODEL_LABEL !== undefined)
     cfg.modelLabel = env.OPENSHARE_MODEL_LABEL;
+  if (env.OPENSHARE_TTL_HOURS)
+    cfg.ttlHours = num(env.OPENSHARE_TTL_HOURS, cfg.ttlHours);
   if (env.OPENSHARE_TTL_DAYS)
-    cfg.ttlDays = num(env.OPENSHARE_TTL_DAYS, cfg.ttlDays);
+    cfg.ttlHours = Math.max(1, Math.floor(num(env.OPENSHARE_TTL_DAYS, 90) * 24));
   if (env.OPENSHARE_AUTH_LOGIN !== undefined)
     cfg.authLogin = env.OPENSHARE_AUTH_LOGIN;
   if (env.OPENSHARE_AUTH_PASSWORD !== undefined)
     cfg.authPassword = env.OPENSHARE_AUTH_PASSWORD;
   if (env.OPENSHARE_URL_FILE !== undefined)
     cfg.urlFile = env.OPENSHARE_URL_FILE;
+  if (env.OPENSHARE_URL_FILE_FORMAT === "json" || env.OPENSHARE_URL_FILE_FORMAT === "url")
+    cfg.urlFileFormat = env.OPENSHARE_URL_FILE_FORMAT;
+  if (env.OPENSHARE_CONFIG_SET)
+    cfg.configSet = env.OPENSHARE_CONFIG_SET;
   if (env.OPENSHARE_SPOOL_DIR)
     cfg.spoolDir = env.OPENSHARE_SPOOL_DIR;
   if (env.OPENSHARE_ANNOUNCE_STDERR !== undefined)
@@ -355,6 +469,7 @@ function resolveShareMode(cfg, input) {
 
 // src/core.ts
 import { appendFileSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
 import { createHash } from "node:crypto";
 import { isAbsolute, join as join2 } from "node:path";
 
@@ -574,6 +689,109 @@ function queueBindingWrite(sid, fn) {
   return run;
 }
 
+// src/redact.ts
+var BUILTINS = [
+  { kind: "aws-key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { kind: "gh-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { kind: "gh-token", re: /\bgithub_pat_[A-Za-z0-9_]{22,255}\b/g },
+  { kind: "api-key", re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+  { kind: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { kind: "google-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: "bearer", re: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  { kind: "private-key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+  { kind: "env-secret", re: /(?<![A-Za-z0-9_])(?:export\s+)?[A-Z0-9_]*(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|CREDENTIALS?)[A-Z0-9_]*\s*=\s*\S+/g },
+  { kind: "conn-string", re: /\b[a-z][a-z0-9+.-]*:\/\/[^:@/\s"']+:[^@/\s"']{4,}@/gi }
+];
+function compile(patterns) {
+  if (!Array.isArray(patterns))
+    return [];
+  const out = [];
+  for (const p of patterns) {
+    if (typeof p !== "string" || !p)
+      continue;
+    try {
+      out.push({ kind: "user", re: new RegExp(p, "g") });
+    } catch {}
+  }
+  return out;
+}
+function tildePath(p, home) {
+  if (!p || !home || p.length <= home.length)
+    return p;
+  const norm = (s) => s.replace(/[\\/]+/g, "/").replace(/\/$/, "");
+  const np = norm(p);
+  const nh = norm(home);
+  if (np === nh)
+    return "~";
+  if (np.startsWith(nh + "/"))
+    return "~" + np.slice(nh.length);
+  return p;
+}
+var PATH_KEYS = new Set(["file", "path", "filePath", "cwd", "directory", "root"]);
+function redactItem(item, opts) {
+  const flat = JSON.stringify(item) ?? "null";
+  const needRedact = opts.enabled && opts.rules.some((r) => {
+    r.re.lastIndex = 0;
+    return r.re.test(flat);
+  });
+  const needPaths = !!opts.home && flat.includes(opts.home);
+  if (!needRedact && !needPaths)
+    return { item, hits: [] };
+  const clone = JSON.parse(flat);
+  const stats = { hits: [], changed: false };
+  walk(clone, opts, stats);
+  return { item: clone, hits: stats.hits };
+}
+function walk(node, opts, stats, key) {
+  if (Array.isArray(node)) {
+    for (let i = 0;i < node.length; i++) {
+      const v = node[i];
+      if (typeof v === "string")
+        node[i] = applyString(v, opts, stats, key);
+      else
+        walk(v, opts, stats, key);
+    }
+    return;
+  }
+  if (node && typeof node === "object") {
+    for (const [k, v] of Object.entries(node)) {
+      if (typeof v === "string")
+        node[k] = applyString(v, opts, stats, k);
+      else
+        walk(v, opts, stats, k);
+    }
+  }
+}
+function applyString(v, opts, stats, key) {
+  let out = v;
+  if (opts.enabled) {
+    for (const r of opts.rules) {
+      r.re.lastIndex = 0;
+      out = out.replace(r.re, (full) => {
+        if (stats.hits.length < 8 && !stats.hits.some((h) => h.kind === r.kind)) {
+          stats.hits.push({ kind: r.kind, sample: full.slice(0, 60) });
+        }
+        stats.changed = true;
+        if (r.kind === "conn-string") {
+          const at = full.lastIndexOf("@");
+          const colon = full.indexOf(":", full.indexOf("://") + 3) + 1;
+          if (at > colon && colon > 0)
+            return full.slice(0, colon) + "[redacted:conn-string]" + full.slice(at);
+        }
+        return `[redacted:${r.kind}]`;
+      });
+    }
+  }
+  if (key && PATH_KEYS.has(key) && opts.home && out.includes(opts.home)) {
+    out = tildePath(out, opts.home);
+    stats.changed = true;
+  }
+  return out;
+}
+function activeRules(userPatterns) {
+  return [...BUILTINS, ...compile(userPatterns)];
+}
+
 // src/core.ts
 var DEFAULT_POLICY = {
   mode: "persistent",
@@ -626,6 +844,19 @@ function redact(info) {
   delete metadata[METADATA_KEY];
   return { ...info, metadata };
 }
+function stripLocalFacts(info) {
+  if (!info || typeof info !== "object")
+    return info;
+  const out = { ...info };
+  let changed = false;
+  for (const k of ["directory", "worktree"]) {
+    if (out[k] !== undefined) {
+      delete out[k];
+      changed = true;
+    }
+  }
+  return changed ? out : info;
+}
 function shareFlag(info) {
   const raw = info?.metadata?.[METADATA_KEY];
   if (!raw || typeof raw !== "object")
@@ -637,8 +868,10 @@ function shareFlag(info) {
   const opts = {};
   if (optsRaw && typeof optsRaw === "object") {
     const o = optsRaw;
-    if (typeof o.ttlDays === "number" && o.ttlDays > 0)
-      opts.ttlDays = o.ttlDays;
+    if (typeof o.ttlHours === "number" && o.ttlHours > 0)
+      opts.ttlHours = Math.floor(o.ttlHours);
+    else if (typeof o.ttlDays === "number" && o.ttlDays > 0)
+      opts.ttlHours = Math.floor(o.ttlDays * 24);
     if (typeof o.authLogin === "string")
       opts.authLogin = o.authLogin;
     if (typeof o.authPassword === "string")
@@ -649,6 +882,8 @@ function shareFlag(info) {
   return { enabled: true, opts: Object.keys(opts).length ? opts : undefined };
 }
 var liveTargets = [];
+var statsProvider = null;
+var redactionLedger = new Map;
 function createEngine(deps) {
   let cfg = loadConfig(deps.pluginDir, deps.options);
   const mode = resolveShareMode(cfg, deps);
@@ -721,40 +956,98 @@ function createEngine(deps) {
   };
   seedCredentials();
   const ENROLL_RETRY_MS = 60000;
+  const setsFetched = new Set;
+  const adoptServerSuggestions = async (url, token) => {
+    if (setsFetched.has(url))
+      return;
+    setsFetched.add(url);
+    try {
+      const r = await fetch(`${url}/api/token/sets`, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(8000)
+      });
+      const body = r.ok ? await r.json().catch(() => null) : null;
+      const sets = body?.sets ?? {};
+      const pick = sets[cfg.configSet ?? ""] ?? Object.values(sets)[0];
+      if (!pick)
+        return;
+      const wantModel = typeof pick.modelLabel === "string" && !pick.modelLabel ? undefined : pick.modelLabel;
+      const wantMode = pick.shareMode === "all" || pick.shareMode === "manual" ? pick.shareMode : undefined;
+      const src = configSourceMap(deps.pluginDir ?? "");
+      const modelUnset = cfg.modelLabel === DEFAULTS.modelLabel && !src.modelLabel;
+      const modeUnset = cfg.shareMode === undefined && !src.shareMode;
+      const adoptModel = wantModel && modelUnset;
+      const adoptMode = wantMode && modeUnset;
+      if (!adoptModel && !adoptMode)
+        return;
+      const home = configHomePath();
+      if (!home)
+        return;
+      let doc = {};
+      try {
+        doc = JSON.parse(readFileSync2(home, "utf8"));
+        if (!doc || typeof doc !== "object")
+          doc = {};
+      } catch {}
+      let dirty = false;
+      if (adoptModel && doc.modelLabel === undefined) {
+        doc.modelLabel = wantModel;
+        dirty = true;
+        log(`${url}: adopted modelLabel from the server config set`);
+      }
+      if (adoptMode && doc.shareMode === undefined) {
+        doc.shareMode = wantMode;
+        dirty = true;
+        log(`${url}: adopted shareMode from the server config set`);
+      }
+      if (dirty)
+        writeFileSync2(home, JSON.stringify(doc, null, 2) + `
+`);
+    } catch {}
+  };
   const ensureCredential = async (url) => {
     const c = credOf(url);
     const target = targets.find((t) => t.url === url);
-    if (c.credential)
+    if (c.credential) {
+      adoptServerSuggestions(url, c.credential);
       return c.credential;
+    }
     if (Date.now() - c.lastEnrollAt < ENROLL_RETRY_MS)
       return "";
     c.lastEnrollAt = Date.now();
-    try {
-      const h = await fetch(`${url}/health`, { signal: AbortSignal.timeout(8000) });
-      const hb = h.ok ? await h.json().catch(() => null) : null;
-      const authMode2 = hb?.auth?.mode;
-      const code = target?.entry.code ?? "";
-      if (authMode2 === "public" || code) {
-        const r = await fetch(`${url}/api/enroll`, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({ code }),
-          signal: AbortSignal.timeout(1e4)
-        });
-        const b = r.ok ? await r.json().catch(() => null) : null;
-        if (b?.ok && typeof b.token === "string") {
-          c.credential = b.token;
+    const code = target?.entry.code ?? "";
+    if (!code) {
+      try {
+        const h = await fetch(`${url}/health`, { signal: AbortSignal.timeout(8000) });
+        const hb = h.ok ? await h.json().catch(() => null) : null;
+        if (hb?.auth?.mode === "public") {
           c.error = "";
-          const savedTo = saveServerToken(url, c.credential);
-          log(`enrolled at ${url} (user ${b.userId} "${b.label}")${savedTo ? " - token saved" : ""}`);
-          return c.credential;
+          return "";
         }
-        c.error = `enroll refused: ${b?.error ?? `HTTP ${r.status}`}`;
-      } else if (authMode2 === "private") {
-        c.error = "private server: add servers.{url}.code (or token) to enroll";
-      } else {
-        c.error = `server health unreachable (HTTP ${h.status})`;
+        c.error = "private server - onboard via /openshare (needs an access code)";
+      } catch (e) {
+        c.error = `server unreachable: ${e?.message || e}`;
       }
+      logError(`no credential for ${url}: ${c.error}`);
+      return "";
+    }
+    try {
+      const r = await fetch(`${url}/api/enroll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code }),
+        signal: AbortSignal.timeout(1e4)
+      });
+      const b = r.ok ? await r.json().catch(() => null) : null;
+      if (b?.ok && typeof b.token === "string") {
+        c.credential = b.token;
+        c.error = "";
+        const savedTo = saveServerToken(url, c.credential);
+        log(`enrolled at ${url} (user ${b.userId} "${b.label}")${savedTo ? " - token saved" : ""}`);
+        adoptServerSuggestions(url, c.credential);
+        return c.credential;
+      }
+      c.error = `enroll refused: ${b?.error ?? `HTTP ${r.status}`}`;
     } catch (e) {
       c.error = `enrollment failed: ${e?.message || e}`;
     }
@@ -1250,8 +1543,15 @@ function createEngine(deps) {
     if (mode === "all" && cfg.urlFile !== URL_FILE_NONE) {
       const file = cfg.urlFile ? isAbsolute(cfg.urlFile) ? cfg.urlFile : join2(deps.directory ?? process.cwd(), cfg.urlFile) : join2(deps.directory ?? process.cwd(), "openshare.urls.txt");
       try {
-        appendFileSync(file, url + `
-`);
+        const line = cfg.urlFileFormat === "json" ? JSON.stringify({
+          id: r.shareId,
+          url,
+          status: st.lastSentStatus ?? "waiting",
+          gated: (st.opts?.authLogin ?? cfg.authLogin ?? "") !== ""
+        }) + `
+` : url + `
+`;
+        appendFileSync(file, line);
         if (cfg.announceStderr && (file !== lastUrlFile || !urlFileAnnounced)) {
           urlFileAnnounced = true;
           lastUrlFile = file;
@@ -1275,7 +1575,20 @@ function createEngine(deps) {
     }
     return { authLogin: login, authPassword: password };
   };
-  const ttlFor = (st) => st.opts?.ttlDays ?? cfg.ttlDays;
+  const ttlFor = (st) => st.opts?.ttlHours ?? cfg.ttlHours;
+  const metaFor = () => {
+    if (!cfg.meta || typeof cfg.meta !== "object")
+      return;
+    const out = {};
+    let n = 0;
+    for (const [k, v] of Object.entries(cfg.meta)) {
+      if (n >= 20)
+        break;
+      out[k] = v.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (m, name) => process.env[name] ?? m);
+      n++;
+    }
+    return Object.keys(out).length ? out : undefined;
+  };
   const applyOpts = (st, opts) => {
     if (!opts)
       return;
@@ -1287,11 +1600,11 @@ function createEngine(deps) {
       if (!r.shareId || !r.secret || !r.wsReady)
         continue;
       const attach = { id: r.shareId, secret: r.secret, ...authFrame(st) };
-      if (st.opts?.ttlDays)
-        attach.ttlDays = st.opts.ttlDays;
+      if (st.opts?.ttlHours)
+        attach.ttlHours = st.opts.ttlHours;
       const sent = wsSend(r, { op: "init", attach });
       if (sent)
-        log(`opts re-synced to ${url.slice(0, 24)}${st.opts?.ttlDays ? ` (ttl ${st.opts.ttlDays}d)` : ""}`);
+        log(`opts re-synced to ${url.slice(0, 24)}${st.opts?.ttlHours ? ` (ttl ${st.opts.ttlHours}h)` : ""}`);
     }
   };
   const deleteAbandoned = (r) => {
@@ -1487,7 +1800,7 @@ function createEngine(deps) {
       if (r.initWasAttach) {
         wsSend(r, { op: "init", attach: { id: r.shareId, secret: r.secret, ...authFrame(st) } });
       } else {
-        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlDays: ttlFor(st), ...authFrame(st) } });
+        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlHours: ttlFor(st), ...authFrame(st), ...cfg.configSet ? { set: cfg.configSet } : {}, ...metaFor() ? { meta: metaFor() } : {} } });
       }
       r.initTimer = setTimeout(() => {
         if (seq !== r.socketSeq)
@@ -1658,7 +1971,7 @@ function createEngine(deps) {
         r.shareId = null;
         r.secret = null;
         r.ackedRev = 0;
-        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlDays: ttlFor(st), ...authFrame(st) } });
+        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlHours: ttlFor(st), ...authFrame(st), ...cfg.configSet ? { set: cfg.configSet } : {}, ...metaFor() ? { meta: metaFor() } : {} } });
         return;
       }
       if (r.initWasAttach && typeof frame.rev === "number" && frame.rev < r.ackedRev) {
@@ -1667,7 +1980,7 @@ function createEngine(deps) {
         r.shareId = null;
         r.secret = null;
         r.ackedRev = 0;
-        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlDays: ttlFor(st), ...authFrame(st) } });
+        wsSend(r, { op: "init", create: { sessionID: st.sid, ttlHours: ttlFor(st), ...authFrame(st), ...cfg.configSet ? { set: cfg.configSet } : {}, ...metaFor() ? { meta: metaFor() } : {} } });
         return;
       }
       const wasFanoutCreate = !r.initWasAttach && st.everConnected;
@@ -1699,9 +2012,10 @@ function createEngine(deps) {
         applyPolicy(frame.policy, r.url);
       r.intentionalClose = false;
       touch(st);
-      if (typeof frame.ttlDays === "number") {
+      const ackTtl = typeof frame.ttlHours === "number" ? frame.ttlHours : typeof frame.ttlDays === "number" ? frame.ttlDays * 24 : undefined;
+      if (typeof ackTtl === "number") {
         const wanted = ttlFor(st);
-        const clamp = wanted != null && frame.ttlDays !== wanted ? { requested: wanted, effective: frame.ttlDays } : null;
+        const clamp = wanted != null && ackTtl !== wanted ? { requested: wanted, effective: ackTtl } : null;
         if (JSON.stringify(clamp) !== JSON.stringify(st.ttlClamped)) {
           st.ttlClamped = clamp;
           scheduleBindingWrite(st);
@@ -1711,6 +2025,28 @@ function createEngine(deps) {
         st.lastError = null;
         scheduleBindingWrite(st);
       }
+      const wantedGate = (st.opts?.authLogin ?? cfg.authLogin ?? "") !== "" && (st.opts?.authPassword ?? cfg.authPassword ?? "") !== "";
+      if (wantedGate && frame.auth === false && !r.warnedNoGate) {
+        r.warnedNoGate = true;
+        logError(`${r.url}: read auth requested but the page has NO gate - check the server's auth handling`);
+      } else if (frame.auth === true) {
+        r.warnedNoGate = false;
+      }
+      if (credOf(r.url).credential) {
+        const priv = {};
+        const dir = deps.directory ?? "";
+        if (dir)
+          priv.directory = dir;
+        if (deps.worktree)
+          priv.worktree = String(deps.worktree);
+        try {
+          priv.home = homedir();
+        } catch {}
+        if (Object.keys(priv).length) {
+          const seq = ++nextSeq;
+          wsSend(r, { op: "sync", items: [{ type: "pmeta", sessionID: st.sid, data: priv }], status: undefined, seq });
+        }
+      }
       announceUrl(st, r);
       if (!st.wroteBinding) {
         chain = chain.then(() => writeBinding(st)).catch(() => {});
@@ -1921,6 +2257,15 @@ function createEngine(deps) {
       }).catch((e) => logError("flush error", e?.message || e));
     }, wait);
   };
+  const homeDir = (() => {
+    try {
+      return homedir();
+    } catch {
+      return "";
+    }
+  })();
+  const userPatterns = cfg.redact?.patterns;
+  const redactionRules = activeRules(userPatterns);
   const enqueue = (st, entry) => {
     if (!st || !entry)
       return;
@@ -1937,6 +2282,22 @@ function createEngine(deps) {
     }
     if (h)
       st.sentHash.set(entry.key, h);
+    {
+      const gate = authFrame(st);
+      const gated = gate.authLogin !== "" && gate.authPassword !== "";
+      const pass = redactItem(entry.item, { rules: redactionRules, home: homeDir, enabled: !gated });
+      if (pass.item !== entry.item)
+        entry = { ...entry, item: pass.item };
+      if (pass.hits.length) {
+        const led = redactionLedger.get(st.sid) ?? { count: 0, samples: [] };
+        led.count += pass.hits.length;
+        for (const hit of pass.hits) {
+          if (led.samples.length < 5 && !led.samples.some((x) => x.kind === hit.kind))
+            led.samples.push(hit);
+        }
+        redactionLedger.set(st.sid, led);
+      }
+    }
     st.queue.set(entry.key, entry.item);
     indexMessage(entry);
     if (debugEvents)
@@ -1945,6 +2306,24 @@ function createEngine(deps) {
     ensureConnected(st);
     scheduleFlush(st);
   };
+  statsProvider = (sid) => {
+    const st = sessions.get(sid);
+    let messages = 0;
+    let toolCalls = 0;
+    if (st) {
+      for (const [, merged] of st.merged) {
+        messages++;
+        const content = merged.content;
+        if (Array.isArray(content))
+          toolCalls += content.filter((c) => !!c && c.type === "tool").length;
+      }
+      for (const it of st.queue.values()) {
+        if (it?.type === "message")
+          messages++;
+      }
+    }
+    return { messages, toolCalls };
+  };
   const msgIndex = new Map;
   const tombstoned = new Set;
   const indexMessage = (entry) => {
@@ -2367,7 +2746,7 @@ function createEngine(deps) {
   const backfillSession = async (st, client, sid, info) => {
     const sessionInfoValue = info ?? await sessionInfo(client, sid);
     if (sessionInfoValue)
-      enqueue(st, itemFor("session", redact(sessionInfoValue), sid));
+      enqueue(st, itemFor("session", stripLocalFacts(redact(sessionInfoValue)), sid));
     let modelSeen = false;
     const consume = (messages) => {
       for (const message of messages) {
@@ -2407,7 +2786,7 @@ function createEngine(deps) {
     if (messages.length === 0 && !info) {
       const fetched = await sessionInfo(client, st.sid);
       if (fetched)
-        enqueue(st, itemFor("session", redact(fetched), st.sid));
+        enqueue(st, itemFor("session", stripLocalFacts(redact(fetched)), st.sid));
     }
     if (typeof client.session.list === "function") {
       try {
@@ -2485,7 +2864,7 @@ function createEngine(deps) {
         const st = sessions.get(parent);
         if (st?.activated && !st.closed) {
           if (info)
-            enqueue(st, itemFor("session", redact(info), sid));
+            enqueue(st, itemFor("session", stripLocalFacts(redact(info)), sid));
         }
         return;
       }
@@ -2496,7 +2875,7 @@ function createEngine(deps) {
           if (flag.opts)
             applyOpts(st, flag.opts);
           if (info)
-            enqueue(st, itemFor("session", redact(info), sid));
+            enqueue(st, itemFor("session", stripLocalFacts(redact(info)), sid));
           if (t === "session.updated")
             chain = chain.then(() => refreshOptOuts(st)).catch(() => {});
           return;
@@ -2548,7 +2927,7 @@ function createEngine(deps) {
     if (!st)
       return;
     if (info)
-      enqueue(st, itemFor("session", redact(info), sid));
+      enqueue(st, itemFor("session", stripLocalFacts(redact(info)), sid));
     if (t === "session.updated" && st.activated && !st.closed) {
       chain = chain.then(() => refreshOptOuts(st)).catch(() => {});
     }