@mirrowel/opencode-openshare 0.2.1 → 0.3.0-dev.1

package/dist/binding-queue.js

@@ -5,8 +5,8 @@
  * the servers map) and the TUI (`patchSessionBinding` in share-flow.ts —
  * opt-outs, collision resolution). Their PATCHes interleave at the host:
  * writer A reads at T0, writer B reads at T1, A PATCHes at T2, B PATCHes
- * at T3 — A's change is silently lost (live-caught class: a TUI opt-out
- * erased by the engine's binding refresh).
+ * at T3, and A's change is silently lost (a TUI opt-out erased by the
+ * engine's binding refresh).
  *
  * Both route their whole read-modify-write through this per-session FIFO.
  * The queue never breaks on errors; entries drop when the process exits.

package/dist/commands.js

@@ -5,14 +5,14 @@
 // auth — one surface, no duplicated manager); on an unshared session it
 // asks consent and creates the share. /openshare opens settings.
 //
-// LAYER SHAPE (live-caught 2026-10-19): the v1 host keymap gates layers
-// that declare `mode` on the mode stack (resting mode is "base"), so a
-// plugin layer MUST NOT pass mode ("global" made the whole layer
-// unreachable — no palette entries, no slash commands, no shadow) and
-// must not carry undefined-valued command fields. The registration shape
-// is exactly what the proven family plugins use: {commands, bindings},
-// commands with only defined fields, category "OpenShare" (own group,
-// deliberately NOT joined into the shared family palette category).
+// LAYER SHAPE: the v1 host keymap gates layers that declare `mode` on the
+// mode stack (resting mode is "base"), so a plugin layer MUST NOT pass mode
+// ("global" made the whole layer unreachable: no palette entries, no slash
+// commands, no shadow) and must not carry undefined-valued command fields.
+// The registration shape is exactly what the proven family plugins use:
+// {commands, bindings}, commands with only defined fields, category
+// "OpenShare" (own group, deliberately NOT joined into the shared family
+// palette category).
 import { clearGoneBindingEntries, currentConfig, hostOf, isConfigured, patchSessionBinding, readBindings, resolveRoot, shareWithConsent, verifyShare, } from "./share-flow.js";
 import { onboardingDialog, settingsDialog } from "./settings.js";
 import { engineTargetUrls } from "./core.js";

package/dist/config.d.ts

@@ -12,6 +12,9 @@ export type ServerEntry = {
     label?: string;
     active?: boolean;
     adminToken?: string;
+    /** The user DECLINED onboarding for this server (asked once, remembered):
+     * shares go out anonymously (public servers only). Cleared by enrolling. */
+    anonymous?: boolean;
 };
 export type ShareConfig = {
     workerUrl: string;
@@ -22,14 +25,33 @@ export type ShareConfig = {
     debounceMs: number;
     completedDelayMs: number;
     modelLabel: string;
-    ttlDays: number;
+    /** Default share lifetime in HOURS (Wave 3; default 2160 = 90d).
+     * Legacy ttlDays config/env is accepted and converted x24. */
+    ttlHours: number;
     authLogin: string;
     authPassword: string;
     spoolDir: string;
     urlFile: string;
+    /** urlFile line format: "url" (default, one bare URL per line) or
+     * "json" (one JSON object per line: id, url, status, gated) for CI
+     * consumers that want machine-readable lines without parsing URLs. */
+    urlFileFormat: "url" | "json";
     /** false silences the `[openshare] live:` (and `url file:`) stderr
      * lines. The share itself is unaffected. */
     announceStderr: boolean;
+    /** Wave 3 redaction: user-supplied regex rules (client-side only)
+     * applied beside the built-in detectors on UNGATED shares. */
+    redact?: {
+        patterns?: string[];
+    };
+    /** B4: which named config set on the server token this agent uses
+     * (unset = the token's first/default set). Rides the create frame. */
+    configSet?: string;
+    /** Free-form string metadata stamped onto every share at create
+     * (labels for team directories/admin listings). Values may reference
+     * env vars as ${NAME} - interpolated at send time; unresolved refs
+     * stay literal so misconfiguration is visible. */
+    meta?: Record<string, string>;
     shareMode?: ShareMode;
 };
 export declare const METADATA_KEY = "openshare";
@@ -64,9 +86,8 @@ export type WriteCandidate = {
 };
 /** Write-target candidates for the TUI picker: the global settings home
  * (always writable) plus every OTHER file in the read chain that already
- * exists on disk (deploy-time overrides are never created from the TUI —
- * owner rule). Order: global first (default), then the rest by read
- * precedence (highest first). */
+ * exists on disk, since the TUI never creates deploy-time overrides. Order:
+ * global first (default), then the rest by read precedence (highest first). */
 export declare function writeCandidates(pluginDir: string, env?: NodeJS.ProcessEnv): WriteCandidate[];
 /** Per-key source attribution mirroring loadConfig precedence exactly
  * (env > adjacent > package root > local walks > global > default).
@@ -77,15 +98,14 @@ export declare function configSourceMap(pluginDir: string, env?: NodeJS.ProcessE
 export declare function normalizeServers(raw: unknown): Record<string, ServerEntry> | undefined;
 /** Field-level merge of servers groups: entries only carry present fields
  * (normalizeServers), so a static `code` in plugin options and a persisted
- * `token` in the settings home combine instead of shadowing — per-URL
- * wholesale replacement would re-enroll on every boot (live-caught in
- * suite design review). */
+ * `token` in the settings home combine instead of shadowing. Per-URL
+ * wholesale replacement would re-enroll on every boot. */
 export declare function mergeServerGroups(base: Record<string, ServerEntry> | undefined, add: Record<string, ServerEntry>): Record<string, ServerEntry>;
 /** The server new sessions share to: the `active` entry (or the first).
- * Legacy workerUrl/createToken merge in as the implicit first entry — with
- * the root token ALSO filed as adminToken (the createToken IS root; filing
- * it only as `token` made the TUI offer user-actions like rotate to a root
- * holder — live-caught "can either be admin or user but not both"). */
+ * Legacy workerUrl/createToken merge in as the implicit first entry, with
+ * the root token ALSO filed as adminToken: the createToken IS root, and
+ * filing it only as `token` offers user-actions like rotate to a root
+ * holder, while an identity is either admin or user, not both. */
 export declare function resolveServer(cfg: ShareConfig): {
     url: string;
     token: string;
@@ -110,9 +130,9 @@ export declare function loadConfig(pluginDir: string, options?: Record<string, u
 export declare function spoolDirFor(cfg: ShareConfig): string;
 /** Does this plugin spec (tui.json entry) point at the openshare package?
  * Accepts the bare npm name, name@version, and the /tui (or any) subpath
- * form — older docs shipped the subpath spec and presence detection must
- * never silently miss it (all-mode would keep auto-sharing while the user
- * believes they installed manual mode — live-caught in review). */
+ * form. Older docs shipped the subpath spec, and presence detection must
+ * never silently miss it: all-mode would keep auto-sharing while the user
+ * believes they installed manual mode. */
 export declare function isOpenShareSpec(spec: unknown): spec is string;
 /** tui.json layers the TUI reads (mirrors the family selfwire path rules,
  * read-only). The walk runs from the session directory up to the worktree

package/dist/config.js

@@ -35,11 +35,13 @@ export const DEFAULTS = {
     // pending flip, so CI runs still land their final status.
     completedDelayMs: 5000,
     modelLabel: "$Provider/$Model",
-    ttlDays: 90,
+    ttlHours: 90 * 24,
     authLogin: "",
     authPassword: "",
     spoolDir: "",
     urlFile: "",
+    urlFileFormat: "url",
+    configSet: "",
     announceStderr: true,
 };
 const CONFIG_NAME = "openshare.config.json";
@@ -97,9 +99,8 @@ export function configHomePath(env = process.env) {
 }
 /** Write-target candidates for the TUI picker: the global settings home
  * (always writable) plus every OTHER file in the read chain that already
- * exists on disk (deploy-time overrides are never created from the TUI —
- * owner rule). Order: global first (default), then the rest by read
- * precedence (highest first). */
+ * exists on disk, since the TUI never creates deploy-time overrides. Order:
+ * global first (default), then the rest by read precedence (highest first). */
 export function writeCandidates(pluginDir, env = process.env) {
     const candidates = [{ path: configHomePath(env), label: "global settings (~/.config/opencode)", always: true }];
     const labels = [
@@ -135,10 +136,13 @@ export function configSourceMap(pluginDir, env = process.env) {
         debounceMs: env.OPENSHARE_DEBOUNCE_MS,
         completedDelayMs: env.OPENSHARE_COMPLETED_DELAY_MS,
         modelLabel: env.OPENSHARE_MODEL_LABEL,
+        ttlHours: env.OPENSHARE_TTL_HOURS,
         ttlDays: env.OPENSHARE_TTL_DAYS,
         authLogin: env.OPENSHARE_AUTH_LOGIN,
         authPassword: env.OPENSHARE_AUTH_PASSWORD,
         urlFile: env.OPENSHARE_URL_FILE,
+        urlFileFormat: env.OPENSHARE_URL_FILE_FORMAT,
+        configSet: env.OPENSHARE_CONFIG_SET,
         spoolDir: env.OPENSHARE_SPOOL_DIR,
         announceStderr: env.OPENSHARE_ANNOUNCE_STDERR,
         shareMode: env.OPENSHARE_SHARE_MODE,
@@ -147,6 +151,28 @@ export function configSourceMap(pluginDir, env = process.env) {
         if (value !== undefined && value !== "")
             sources[key] = "environment";
     }
+    // legacy days-shaped env feeds the same knob as ttlHours
+    if (sources.ttlDays && !sources.ttlHours)
+        sources.ttlHours = sources.ttlDays;
+    delete sources.ttlDays;
+    // OPENSHARE_CONFIG_JSON sits between env and the files: it loses only
+    // to a specific env var, so it overrides any file's key
+    if (env.OPENSHARE_CONFIG_JSON) {
+        try {
+            const raw = JSON.parse(env.OPENSHARE_CONFIG_JSON);
+            if (raw && typeof raw === "object") {
+                for (const [key, value] of Object.entries(raw)) {
+                    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+                        continue;
+                    if (sources[key] === "environment")
+                        continue;
+                    if (key === "servers" || known.has(key))
+                        sources[key] = "OPENSHARE_CONFIG_JSON";
+                }
+            }
+        }
+        catch { }
+    }
     // configPaths() is ordered lowest-priority-first? No: index 0 is the
     // ADJACENT file (highest). Merge order reverses it; attribution walks
     // it as-is so the first hit is the winning (highest) source.
@@ -206,15 +232,16 @@ export function normalizeServers(raw) {
             entry.adminToken = e.adminToken;
         if (e.active === true)
             entry.active = true;
+        if (e.anonymous === true)
+            entry.anonymous = true;
         out[url] = entry;
     }
     return Object.keys(out).length ? out : undefined;
 }
 /** Field-level merge of servers groups: entries only carry present fields
  * (normalizeServers), so a static `code` in plugin options and a persisted
- * `token` in the settings home combine instead of shadowing — per-URL
- * wholesale replacement would re-enroll on every boot (live-caught in
- * suite design review). */
+ * `token` in the settings home combine instead of shadowing. Per-URL
+ * wholesale replacement would re-enroll on every boot. */
 export function mergeServerGroups(base, add) {
     const merged = { ...(base ?? {}) };
     for (const [url, entry] of Object.entries(add))
@@ -222,10 +249,10 @@ export function mergeServerGroups(base, add) {
     return merged;
 }
 /** The server new sessions share to: the `active` entry (or the first).
- * Legacy workerUrl/createToken merge in as the implicit first entry — with
- * the root token ALSO filed as adminToken (the createToken IS root; filing
- * it only as `token` made the TUI offer user-actions like rotate to a root
- * holder — live-caught "can either be admin or user but not both"). */
+ * Legacy workerUrl/createToken merge in as the implicit first entry, with
+ * the root token ALSO filed as adminToken: the createToken IS root, and
+ * filing it only as `token` offers user-actions like rotate to a root
+ * holder, while an identity is either admin or user, not both. */
 export function resolveServer(cfg) {
     const servers = {};
     if (cfg.workerUrl)
@@ -302,29 +329,58 @@ export function loadConfig(pluginDir, options) {
     const cfg = { ...DEFAULTS };
     const emptyMeansUnset = new Set(["workerUrl", "createToken", "urlFile", "spoolDir"]);
     const known = new Set([...Object.keys(DEFAULTS), "shareMode"]);
+    const applyObject = (raw) => {
+        if (!raw || typeof raw !== "object")
+            return;
+        for (const [key, value] of Object.entries(raw)) {
+            if (key === "servers") {
+                const servers = normalizeServers(value);
+                if (servers)
+                    cfg.servers = mergeServerGroups(cfg.servers, servers);
+                continue;
+            }
+            if (key === "redact") {
+                if (value && typeof value === "object" && Array.isArray(value.patterns)) {
+                    const pats = value.patterns.filter((x) => typeof x === "string" && x.length > 0 && x.length < 500).slice(0, 50);
+                    cfg.redact = { patterns: pats };
+                }
+                continue;
+            }
+            if (key === "meta") {
+                // string-to-string only: meta rides the create frame verbatim
+                if (value && typeof value === "object" && !Array.isArray(value)) {
+                    const clean = {};
+                    for (const [mk, mv] of Object.entries(value)) {
+                        if (typeof mv === "string" && mv.length <= 500 && mk.length <= 64)
+                            clean[mk] = mv;
+                    }
+                    if (Object.keys(clean).length)
+                        cfg.meta = { ...cfg.meta, ...clean };
+                }
+                continue;
+            }
+            if (key === "ttlDays") {
+                // legacy days-shaped file/options value converts to hours once
+                const d = Math.floor(Number(value));
+                if (Number.isFinite(d) && d > 0)
+                    cfg.ttlHours = d * 24;
+                continue;
+            }
+            if (!known.has(key))
+                continue;
+            if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+                continue;
+            if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
+                continue;
+            cfg[key] = value;
+        }
+    };
     for (const path of [...configPaths(pluginDir)].reverse()) {
         try {
             // strict JSON: the $comment key (what our templates use) is valid
             // JSON; comment-stripping is deliberately avoided because a naive
             // stripper eats "//" inside workerUrl values
-            const raw = JSON.parse(readFileSync(path, "utf8"));
-            if (!raw || typeof raw !== "object")
-                continue;
-            for (const [key, value] of Object.entries(raw)) {
-                if (key === "servers") {
-                    const servers = normalizeServers(value);
-                    if (servers)
-                        cfg.servers = mergeServerGroups(cfg.servers, servers);
-                    continue;
-                }
-                if (!known.has(key))
-                    continue;
-                if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
-                    continue;
-                if (typeof value === "string" && value === "" && emptyMeansUnset.has(key))
-                    continue;
-                cfg[key] = value;
-            }
+            applyObject(JSON.parse(readFileSync(path, "utf8")));
         }
         catch (e) {
             // a malformed config file is a real setup error the user must hear
@@ -353,6 +409,19 @@ export function loadConfig(pluginDir, options) {
             cfg.shareMode = mode;
     }
     const env = process.env;
+    // OPENSHARE_CONFIG_JSON: a complete config object in one env var. Sits
+    // between the file/options layers and the per-key OPENSHARE_* env (a
+    // specific env var still wins) - CI sets one variable instead of nine,
+    // and secrets never touch a file. Malformed JSON is a loud error, not
+    // silence (same rule as files).
+    if (env.OPENSHARE_CONFIG_JSON) {
+        try {
+            applyObject(JSON.parse(env.OPENSHARE_CONFIG_JSON));
+        }
+        catch (e) {
+            console.error("[openshare] OPENSHARE_CONFIG_JSON could not be parsed - ignored:", e?.message ?? e);
+        }
+    }
     if (env.OPENSHARE_WORKER_URL)
         cfg.workerUrl = env.OPENSHARE_WORKER_URL;
     if (env.OPENSHARE_CREATE_TOKEN)
@@ -363,14 +432,20 @@ export function loadConfig(pluginDir, options) {
         cfg.completedDelayMs = num(env.OPENSHARE_COMPLETED_DELAY_MS, cfg.completedDelayMs);
     if (env.OPENSHARE_MODEL_LABEL !== undefined)
         cfg.modelLabel = env.OPENSHARE_MODEL_LABEL;
+    if (env.OPENSHARE_TTL_HOURS)
+        cfg.ttlHours = num(env.OPENSHARE_TTL_HOURS, cfg.ttlHours);
     if (env.OPENSHARE_TTL_DAYS)
-        cfg.ttlDays = num(env.OPENSHARE_TTL_DAYS, cfg.ttlDays);
+        cfg.ttlHours = Math.max(1, Math.floor(num(env.OPENSHARE_TTL_DAYS, 90) * 24));
     if (env.OPENSHARE_AUTH_LOGIN !== undefined)
         cfg.authLogin = env.OPENSHARE_AUTH_LOGIN;
     if (env.OPENSHARE_AUTH_PASSWORD !== undefined)
         cfg.authPassword = env.OPENSHARE_AUTH_PASSWORD;
     if (env.OPENSHARE_URL_FILE !== undefined)
         cfg.urlFile = env.OPENSHARE_URL_FILE;
+    if (env.OPENSHARE_URL_FILE_FORMAT === "json" || env.OPENSHARE_URL_FILE_FORMAT === "url")
+        cfg.urlFileFormat = env.OPENSHARE_URL_FILE_FORMAT;
+    if (env.OPENSHARE_CONFIG_SET)
+        cfg.configSet = env.OPENSHARE_CONFIG_SET;
     if (env.OPENSHARE_SPOOL_DIR)
         cfg.spoolDir = env.OPENSHARE_SPOOL_DIR;
     if (env.OPENSHARE_ANNOUNCE_STDERR !== undefined)
@@ -421,9 +496,9 @@ function specPath(spec) {
 }
 /** Does this plugin spec (tui.json entry) point at the openshare package?
  * Accepts the bare npm name, name@version, and the /tui (or any) subpath
- * form — older docs shipped the subpath spec and presence detection must
- * never silently miss it (all-mode would keep auto-sharing while the user
- * believes they installed manual mode — live-caught in review). */
+ * form. Older docs shipped the subpath spec, and presence detection must
+ * never silently miss it: all-mode would keep auto-sharing while the user
+ * believes they installed manual mode. */
 export function isOpenShareSpec(spec) {
     if (typeof spec !== "string" || spec.length === 0)
         return false;

package/dist/contract.d.ts

@@ -1,8 +1,8 @@
 export declare const CONTRACT_VERSION = 2;
 /** Message tombstone item. sessionID MUST ride along: viewers key
- * messages as message/<sessionID>/<id> — an unstamped del misses the
- * key and undone turns resurrect on the live page (live-caught
- * 2026-10-21, refresh-correct because the worker keys differently). */
+ * messages as message/<sessionID>/<id>, so an unstamped del misses the key
+ * and undone turns resurrect on the live page (a refresh hides them because
+ * the worker keys items differently). */
 export declare function messageTombstone(sessionID: string, messageID: string): {
     readonly type: "message";
     readonly del: true;
@@ -151,6 +151,6 @@ export declare function normalizeV1Message(info: Record<string, unknown>, parts:
 export declare function normalizeV1Diff(diff: unknown): unknown;
 /** v1 hosts paginate messages with an opaque cursor: base64url of
  * {id, time} where time = the page tail's time_created (message-v2.ts
- * cursor codec). A bare message id is rejected with 400 — that silently
- * truncated every v1 backfill to one page (live-caught). */
+ * cursor codec). A bare message id is rejected with 400, which silently
+ * truncates a v1 backfill to one page. */
 export declare function cursorFor(id: string, time: number): string;

package/dist/contract.js

@@ -19,9 +19,9 @@
 // the whole message (parts are embedded; no cascade needed).
 export const CONTRACT_VERSION = 2;
 /** Message tombstone item. sessionID MUST ride along: viewers key
- * messages as message/<sessionID>/<id> — an unstamped del misses the
- * key and undone turns resurrect on the live page (live-caught
- * 2026-10-21, refresh-correct because the worker keys differently). */
+ * messages as message/<sessionID>/<id>, so an unstamped del misses the key
+ * and undone turns resurrect on the live page (a refresh hides them because
+ * the worker keys items differently). */
 export function messageTombstone(sessionID, messageID) {
     return { type: "message", del: true, sessionID, data: { id: messageID } };
 }
@@ -256,8 +256,8 @@ export function normalizeV1Diff(diff) {
 }
 /** v1 hosts paginate messages with an opaque cursor: base64url of
  * {id, time} where time = the page tail's time_created (message-v2.ts
- * cursor codec). A bare message id is rejected with 400 — that silently
- * truncated every v1 backfill to one page (live-caught). */
+ * cursor codec). A bare message id is rejected with 400, which silently
+ * truncates a v1 backfill to one page. */
 export function cursorFor(id, time) {
     return Buffer.from(JSON.stringify({ id, time })).toString("base64url");
 }

package/dist/core.d.ts

@@ -1,4 +1,5 @@
 import { type ShareConfig, type ShareMode } from "./config.js";
+import { type RedactionHit } from "./redact.js";
 export type SessionModel = {
     providerID?: string;
     modelID?: string;
@@ -55,7 +56,7 @@ export type ShareEvent = {
     sessionID: string;
 };
 export type SessionOpts = {
-    ttlDays?: number;
+    ttlHours?: number;
     authLogin?: string;
     authPassword?: string;
     modelLabel?: string;
@@ -114,5 +115,15 @@ export type Engine = {
     mode: ShareMode;
     config: () => ShareConfig;
 };
+/** Preflight stats for the consent dialog: message/tool counts plus the
+ * redaction ledger (what would be stripped before publishing). */
+export declare function sessionStatsFor(sid: string): {
+    messages: number;
+    toolCalls: number;
+    redaction: {
+        count: number;
+        samples: RedactionHit[];
+    };
+};
 export declare function engineTargetUrls(): string[];
 export declare function createEngine(deps: EngineDeps): Engine;