@mirrowel/opencode-openshare 0.2.1 → 0.3.0-dev.10

package/src/share-flow.ts

@@ -17,7 +17,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs"
 import { loadConfig, moduleDir, configPaths, configHomePath, resolveServer, saveServerEntry, deleteServerEntry, METADATA_KEY, type ShareConfig, type ServerEntry } from "./config.js"
 import { dbg, dbgLog } from "./sidebar.js"
-import { engineTargetUrls, type ClientApi, type SessionInfo, type SessionOpts } from "./core.js"
+import { engineTargetUrls, sessionStatsFor, type ClientApi, type SessionInfo, type SessionOpts } from "./core.js"
 import { queueBindingWrite } from "./binding-queue.js"
 import type { ShareHostApi } from "./tui-host.js"
 
@@ -44,11 +44,10 @@ export function currentConfig(baseDir: string = moduleDir()): ShareConfig {
   return loadConfig(baseDir)
 }
 
-/** Writes the config file. Target rule (owner-directed): the global
- * settings home by default, or an explicit existing file chosen in the
- * TUI — NEVER "first existing in the read chain" (that wrote TUI edits
- * into the tracked adjacent template, live-caught). $comment and foreign
- * keys preserved. */
+/** Writes the config file. Target rule: the global settings home by
+ * default, or an explicit existing file chosen in the TUI, never "first
+ * existing in the read chain" (that writes TUI edits into the tracked
+ * adjacent template). $comment and foreign keys preserved. */
 export function saveConfig(cfg: ShareConfig, target?: string, baseDir: string = moduleDir()): { path: string } | undefined {
   const path = target ?? configHomePath()
   if (!path) return undefined
@@ -71,7 +70,7 @@ export function saveConfig(cfg: ShareConfig, target?: string, baseDir: string =
       "debounceMs",
       "completedDelayMs",
       "modelLabel",
-      "ttlDays",
+      "ttlHours",
       "authLogin",
       "authPassword",
       "spoolDir",
@@ -171,6 +170,24 @@ export async function readBindings(client: ClientApi | undefined, sid: string):
   return bindingsOf(await getSession(client, sid))
 }
 
+/** Human TTL from hours: "6h", "2d", "90d" (the TUI prompt accepts
+ * these same shapes back). */
+export function fmtHours(hours: number): string {
+  if (!Number.isFinite(hours) || hours <= 0) return "?"
+  if (hours % 24 === 0) return `${Math.floor(hours / 24)}d`
+  return `${Math.floor(hours)}h`
+}
+
+/** Parse "6h" / "2d" / "48" into hours (bare number = hours). */
+export function parseTtlHours(raw: string): number | undefined {
+  const m = /^\s*(\d+(?:\.\d+)?)\s*(h|d|hr|hours?|days?)?\s*$/i.exec(raw ?? "")
+  if (!m) return undefined
+  const v = Number(m[1])
+  if (!Number.isFinite(v) || v <= 0) return undefined
+  const unit = (m[2] ?? "h").toLowerCase()
+  return Math.max(1, Math.floor(unit.startsWith("d") ? v * 24 : v))
+}
+
 export function hostOf(url: string): string {
   try {
     return new URL(url).host
@@ -333,6 +350,36 @@ export async function workerDeleteShare(workerUrl: string, id: string, secret: s
   }
 }
 
+/** PATCH a live share's settings over REST (#13): immediate effect with
+ * no socket required (the engine's attach-sync remains the structural
+ * path - this is the same edit pushed now, per server). Auth sends as
+ * the both-or-none pair or not at all; ttlHours only when explicit. */
+export async function patchShareOpts(
+  workerUrl: string,
+  id: string,
+  opts: { authLogin?: string; authPassword?: string; ttlHours?: number },
+  secret: string,
+): Promise<{ ok: boolean; error?: string }> {
+  const body: Record<string, unknown> = { secret }
+  if (opts.authLogin !== undefined && opts.authPassword !== undefined) {
+    body.authLogin = opts.authLogin
+    body.authPassword = opts.authPassword
+  }
+  if (opts.ttlHours !== undefined) body.ttlHours = opts.ttlHours
+  try {
+    const res = await fetch(`${workerUrl.replace(/\/$/, "")}/api/share/${id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(8000),
+    })
+    const json = (await res.json().catch(() => ({}))) as { ok?: boolean; error?: string }
+    return res.ok && json.ok ? { ok: true } : { ok: false, error: json.error ?? `HTTP ${res.status}` }
+  } catch (e) {
+    return { ok: false, error: (e as Error)?.message || String(e) }
+  }
+}
+
 /** Health probe for the settings dialog's connection test. */
 export async function probeWorker(workerUrl: string): Promise<{ ok: boolean; detail: string }> {
   if (!workerUrl) return { ok: false, detail: "workerUrl is empty" }
@@ -554,12 +601,13 @@ export type FlowResult = { ok: boolean; message: string; url?: string; unconfigu
  * directive — no remembered consent, no silent creates). The dialog
  * carries the live context (server, TTL, gate state) so the decision is
  * informed, not ceremonial. */
-export async function requestShareConsent(host: ShareHostApi, context?: { server?: string; ttlDays?: number; auth: boolean }): Promise<boolean> {
+export async function requestShareConsent(host: ShareHostApi, context?: { server?: string; ttlHours?: number; auth: boolean; counts?: { messages: number; toolCalls: number }; redaction?: { hits: number; samples: string[] } }): Promise<boolean> {
   const lines: string[] = ["Publish this session (and its subagent sessions) to your openshare worker?"]
   if (context) {
     const bits: string[] = []
     if (context.server) bits.push(`server: ${context.server}`)
-    if (context.ttlDays !== undefined) bits.push(`TTL: ${context.ttlDays}d`)
+    if (context.ttlHours !== undefined) bits.push(`TTL: ${fmtHours(context.ttlHours)}`)
+    if (context.redaction && context.redaction.hits > 0) bits.push(`redaction: ${context.redaction.hits} hit(s)`)
     bits.push(`read auth: ${context.auth ? "on" : "off"}`)
     lines.push(bits.join(" - "))
   }
@@ -594,14 +642,22 @@ export async function shareWithConsent(host: ShareHostApi, sessionID: string | u
   }
   const opts = all[0]?.opts
   const server = serverEntries(cfg).find((s) => s.active) ?? serverEntries(cfg)[0] ?? (engineTargetUrls()[0] ? { url: engineTargetUrls()[0] } : undefined)
-  if (
-    !(await requestShareConsent(host, {
-      server: server ? hostOf(server.url) : undefined,
-      ttlDays: opts?.ttlDays ?? cfg.ttlDays,
-      auth: !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword),
-    }))
-  )
-    return { ok: false, message: "Share cancelled." }
+  {
+    const stats = sessionStatsFor(root)
+    const gated = !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword)
+    if (
+      !(await requestShareConsent(host, {
+        server: server ? hostOf(server.url) : undefined,
+        ttlHours: opts?.ttlHours ?? cfg.ttlHours,
+        auth: gated,
+        counts: { messages: stats.messages, toolCalls: stats.toolCalls },
+          // redaction only runs on ungated shares (a gated share is
+        // private from casual observers; the ledger reflects that)
+        redaction: gated ? undefined : { hits: stats.redaction.count, samples: stats.redaction.samples.map((h) => `${h.sample} [${h.kind}]`) },
+      }))
+    )
+      return { ok: false, message: "Share cancelled." }
+  }
   return confirmShare(host, root)
 }
 
@@ -621,9 +677,9 @@ export async function confirmShare(host: ShareHostApi, rootSessionID: string): P
   const binding = await waitForBinding(host.client, rootSessionID)
   dbgLog(`confirmShare: waitForBinding -> ${binding?.url ? binding.url : "timeout"}`)
   if (!binding?.url) {
-    // a failed create must NOT leave the flag armed - the engine would
-    // publish LATER with no further consent (live-caught). Disarm now;
-    // re-running /share re-consents.
+    // a failed create must NOT leave the flag armed: the engine would
+    // publish LATER with no further consent. Disarm now; re-running
+    // /share re-consents.
     await clearShareFlag(host.client, rootSessionID)
     const fresh = await readBinding(host.client, rootSessionID)
     const why = fresh?.lastError ? `\nReason: ${fresh.lastError}` : ""

package/src/sidebar.tsx

@@ -9,13 +9,13 @@
 // v1-only: the v2 TUI plugin context has no slot registry. The v2 adapter
 // simply skips this module.
 //
-// SLOT CONTRACT (live-caught 2x): (1) @opentui/core SlotRenderer is called
-// as (ctx, props) — CONTEXT FIRST. (2) The payload MUST be box-rooted:
-// a text root with text children is not hostable through the slot
-// machinery ("TextNodeRenderable only accepts strings…" on embed). Every
-// proven consumer returns box-rooted trees (opencode's own default
-// children, magic-context's sidebar, the host's slot self-test); text
-// nodes stay LEAVES here — string content only.
+// SLOT CONTRACT: (1) @opentui/core SlotRenderer is called as (ctx, props),
+// CONTEXT FIRST. (2) The payload MUST be box-rooted: a text root with text
+// children is not hostable through the slot machinery
+// ("TextNodeRenderable only accepts strings..." on embed). Every proven
+// consumer returns box-rooted trees (opencode's own default children,
+// magic-context's sidebar, the host's slot self-test); text nodes stay
+// LEAVES here, string content only.
 
 import type { JSX } from "@opentui/solid"
 import { bindingsOf, bindingOf, verifyShare } from "./share-flow.js"

package/src/tui.tsx

@@ -42,13 +42,12 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
     hostVersion: 1,
     app: { version: api.app?.version },
     // 1.19.x hands plugins the v2 SDK client — a LAZY PROXY (methods
-    // materialize on property access; spreading it destroys them, which
-    // broke session.update: live-caught "no client.session.update" after
-    // the adapter was added). Wrap with passthrough Proxies instead:
-    //  - path args are translated id -> sessionID (the v2 SDK's URL
-    //    builder left "{sessionID}" literally in the URL for {path:{id}}
-    //    calls — server log: "Expected a string starting with ses, got
-    //    %7BsessionID%7D" — so every session.get/update failed silently),
+    // materialize on property access, and spreading it destroys them, which
+    // breaks session.update). Wrap with passthrough Proxies instead:
+    //  - path args are translated id -> sessionID (the v2 SDK's URL builder
+    //    left "{sessionID}" literally in the URL for {path:{id}} calls, so
+    //    every session.get/update failed silently with
+    //    "Expected a string starting with ses, got %7BsessionID%7D"),
     //  - session.get fills metadata from the state store when the v2
     //    response lacks it,
     //  - everything else reaches the original proxy untouched.
@@ -139,10 +138,10 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
     theme: api.theme,
     ui: {
       toast: (input) => api.ui.toast(input),
-      // dialog.clear() THROWS on an already-empty stack on 1.19.x — and
-      // flows legitimately clear after my components already settled+cleared
-      // (the throw killed confirmShare before it started, live-caught via
-      // the debug log). Idempotent wrapper for every call site.
+      // dialog.clear() THROWS on an already-empty stack on 1.19.x, and flows
+      // legitimately clear after the components already settled and cleared;
+      // the throw kills confirmShare before it starts. Idempotent wrapper for
+      // every call site.
       dialog: new Proxy({} as ShareHostApi["ui"]["dialog"], {
         get: (_t, key: string) => {
           if (key === "clear")
@@ -185,14 +184,13 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
       },
       // CUSTOM interactive dialogs (family MenuDialog pattern: own
       // priority-10000 key layer + mode push + input shield). The host's
-      // ui.DialogX components under plugin dialog.replace render but
-      // receive no keys on opencode 1.19.x (live-caught + pty-reproduced).
-      // These are component functions: flows invoke them inside their own
-      // dialog.replace(() => ...) render thunk (the host renders the thunk
-      // in a proper Solid root, so the hooks inside run with an owner).
-      // DialogX bridge shims (v2 adapter / legacy call sites): route to the
-      // ported promise menus. Nothing on v1 renders these through
-      // dialog.replace anymore — flows use showMenu/showConfirm directly.
+      // ui.DialogX components under plugin dialog.replace render but receive
+      // no keys on opencode 1.19.x. These are component functions: flows
+      // invoke them inside their own dialog.replace(() => ...) render thunk,
+      // and the host renders the thunk in a proper Solid root so the hooks
+      // inside run with an owner. DialogX bridge shims (v2 adapter / legacy
+      // call sites) route to the ported promise menus; no v1 flow renders
+      // through dialog.replace anymore, flows use showMenu/showConfirm.
       DialogSelect: (props) => {
         void showMenuOnce(api, { title: props.title, options: toMenuOptions(props.options), current: props.current, hint: props.placeholder }).then((value) => {
           if (value === undefined) (props as { onCancel?: () => void }).onCancel?.()
@@ -251,11 +249,11 @@ export function buildV1HostApi(api: TuiPluginApi): ShareHostApi {
       return route.name === "session" ? (route.params?.sessionID as string | undefined) : undefined
     },
     clipboard: {
-      // navigator.clipboard.writeText resolves as a silent no-op in the
-      // TUI runtime (live-caught: the menu copy said "copied" but nothing
-      // landed; the sidebar chip worked because it falls back to OSC52).
-      // Belt-and-braces: try navigator, then ALWAYS emit the OSC52 escape
-      // — harmless when the terminal ignores it, correct when it honors it.
+      // navigator.clipboard.writeText resolves as a silent no-op in the TUI
+      // runtime: the menu reports "copied" and nothing lands (the sidebar chip
+      // works because it falls back to OSC52). Belt-and-braces: try navigator,
+      // then ALWAYS emit the OSC52 escape, which is harmless when the terminal
+      // ignores it and correct when it honors it.
       async write(text) {
         let ok = false
         try {

package/src/ui-prefs.ts

@@ -1,9 +1,9 @@
-// Host-agnostic dialog size preferences (owner decision 2026-10-19: host
-// kv, not the config file — UI settings are per-host and synced by
-// opencode itself). dialog width maps to the host's fixed dialog widths;
-// height is a percent of terminal rows. v1 dialogs apply these directly
-// (dialogs.tsx); the settings dialog edits them through this module so the
-// flows stay host-agnostic.
+// Host-agnostic dialog size preferences, stored in host kv rather than the
+// config file because UI settings are per-host and synced by opencode
+// itself. Dialog width maps to the host's fixed dialog widths; height is a
+// percent of terminal rows. v1 dialogs apply these directly (dialogs.tsx);
+// the settings dialog edits them through this module so the flows stay
+// host-agnostic.
 
 export const UI_WIDTH_KV = "openshare.ui-width"
 export const UI_HEIGHT_PERCENT_KV = "openshare.ui-height-percent"

package/src/v2-server.ts

@@ -229,12 +229,11 @@ export function createV2ServerSetup() {
     // the client adapter and feed them into the engine as the v1 events it
     // understands (session.updated / message.updated / message.part.updated).
     // The engine's keyed queue makes repeated re-syncs idempotent.
-    // NOTE: no content-hash dedupe here — a refresh that runs while the
-    // session is still dormant (pre-flag) would poison the cache without
-    // emitting anything, and the flag-time refresh would then SKIP the
-    // unchanged messages (live-caught in the v2 mock suite: the share's
-    // first assistant content arrived only as the next change). The dedupe
-    // belongs engine-side, where dormancy is known, if it's ever needed.
+    // NOTE: no content-hash dedupe here. A refresh running while the session
+    // is still dormant (pre-flag) would poison the cache without emitting
+    // anything, and the flag-time refresh would then SKIP the unchanged
+    // messages, so the share's first assistant content would only arrive on
+    // the next change. Dedupe belongs engine-side, where dormancy is known.
     const pendingRefresh = new Map<string, ReturnType<typeof setTimeout>>()
     // queued inbox inputs per session: v2 persists the prompt in the inbox
     // (delivery "queue") while the current turn still runs — the message