@mirrowel/opencode-openshare 0.2.1 → 0.3.0-dev.10

package/dist/settings.js

@@ -4,8 +4,8 @@
 // run on the v1 TUI and the v2 dialog bridge.
 //
 // Sections: Connection, Sharing, Read auth, Advanced, This session.
-import { configSourceMap, moduleDir, writeCandidates } from "./config.js";
-import { adminClient, adminTokenFor, currentConfig, deleteServerEntry, disconnectAtServer, enrollAtServer, hostOf, isConfigured, normServerUrl, probeAuthMode, probeWorker, patchSessionBinding, readBinding, readBindings, resolveRoot, rotateAtServer, runUnshareFlow, saveConfig, saveServerEntry, meClient, serverEntries, setShareOpts, shareWithConsent, workerDeleteShare, } from "./share-flow.js";
+import { configSourceMap, moduleDir, pluginVersion, writeCandidates } from "./config.js";
+import { adminClient, adminTokenFor, currentConfig, deleteServerEntry, disconnectAtServer, enrollAtServer, fmtHours, parseTtlHours, hostOf, isConfigured, normServerUrl, probeAuthMode, probeWorker, patchSessionBinding, patchShareOpts, readBinding, readBindings, resolveRoot, rotateAtServer, runUnshareFlow, saveConfig, saveServerEntry, meClient, serverEntries, setShareOpts, shareWithConsent, workerDeleteShare, } from "./share-flow.js";
 import { DIALOG_WIDTH_COLUMNS, kvHeightPercentOf, kvWidthOf, nextDialogWidth, UI_HEIGHT_PERCENT_KV, UI_WIDTH_KV, clampHeightPercent } from "./ui-prefs.js";
 /** description suffix: `[from <source>]` when a key is overridden by a
  * file/env higher in the chain than the write target. */
@@ -89,13 +89,13 @@ const LABELS = {
         info: 'How the model name appears on the share page. "$Provider/$Model" renders e.g. "closedrouter/zai/glm-5.3". Any literal text is used as-is; empty string hides the model line entirely.',
         def: '"$Provider/$Model"',
     },
-    ttlDays: {
-        label: "TTL (days)",
-        help: "Share lifetime; the worker caps it at its MAX_TTL_DAYS.",
+    ttlHours: {
+        label: "TTL (hours)",
+        help: "Share lifetime in hours (2d writes 48); capped server-side.",
         kind: "number",
         section: "Sharing",
-        info: "How long pages live before the server's sweeper deletes them. Capped server-side: the deployment's MAX_TTL_DAYS and the token's maxTtlDays limit both apply.\n\nA per-session override lives in the This-session section; it is sent at create/attach time.",
-        def: "worker cap (90 on the reference deployment)",
+        info: "How long pages live before the server's sweeper deletes them, in HOURS. Capped server-side: the deployment's MAX_TTL_HOURS (legacy MAX_TTL_DAYS converted) and the token's limit both apply; the floor is one hour.\n\nA per-session override lives in the This-session section; it is sent at create/attach time. The session prompt takes 6h / 2d style input.",
+        def: "worker cap (2160h = 90d on the reference deployment)",
     },
     authLogin: {
         label: "Read auth: login",
@@ -165,8 +165,8 @@ async function editKey(host, cfg, key) {
     const meta = LABELS[key];
     if (!meta)
         return undefined;
-    // selection-backed settings (owner: "setting share mode i need to enter it
-    // manually? No selection?") — fixed vocabularies become menus
+    // selection-backed settings: fixed vocabularies become menus instead of
+    // asking for a typed value
     if (meta.options) {
         const current = String(cfg[key] ?? "");
         const picked = await showSelect(host.ui, {
@@ -214,10 +214,14 @@ async function editKey(host, cfg, key) {
     }
     return next;
 }
-/** Connect (add + enroll) a server — the /share first-run flow and the
+/** Connect (add + enroll) a server - the /share first-run flow and the
  * settings "Connect to a server" row share it. Prompts the URL, probes
- * the auth mode, prompts a code for private servers, enrolls, persists
- * the token and makes it the active server. */
+ * the auth mode, then ASKS ONCE: onboard to an account, or stay anonymous
+ * (public servers only; anonymous shares sit under the server's global
+ * caps). Onboarding detects whether a code is needed and only then prompts
+ * for one (a code already in config is used without asking). The outcome is
+ * remembered per server: a token means onboarded, an anonymous flag means
+ * declined. */
 export async function connectServerFlow(host) {
     const raw = await showPrompt(host.ui, { title: "Share server URL", placeholder: "https://your-openshare-host" });
     if (raw === undefined || raw === "")
@@ -225,33 +229,84 @@ export async function connectServerFlow(host) {
     const url = normServerUrl(raw);
     if (!/^https?:\/\//.test(url))
         return { ok: false, message: "URL must start with http:// or https://" };
-    host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}…` });
+    host.ui.toast({ variant: "info", title: "OpenShare", message: `Probing ${url}:` });
     const probe = await probeAuthMode(url);
     if (!probe.ok)
         return { ok: false, message: `${url}: ${probe.detail}` };
-    let code = "";
-    if (probe.mode === "private") {
-        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" });
+    const existing = serverEntries().find((sv) => sv.url === url)?.entry ?? {};
+    const deactivateOthers = () => {
+        for (const other of serverEntries()) {
+            if (other.url !== url)
+                saveServerEntry(other.url, { active: undefined });
+        }
+    };
+    if (probe.mode === "public") {
+        // the ask: an account is a real thing (own shares, own limits,
+        // revocable credentials) - but anonymous sharing works too
+        const picked = await showSelect(host.ui, {
+            title: `${url} - account?`,
+            options: [
+                {
+                    value: "onboard",
+                    title: "Onboard (get an account)",
+                    description: "your own user, tokens and share limits; survives the server's anonymous caps",
+                    help: "An account gives you a revocable identity with your own share registry and limits. Depending on the server you may need a one-time access code from the hoster - you'll be asked only if it's required.",
+                },
+                {
+                    value: "anon",
+                    title: "Stay anonymous",
+                    description: "share without an account; counts against the server-wide anonymous limits",
+                    help: "No identity, no token to manage. Shares are ownerless: whoever holds the share's secret controls them, and the server may throttle anonymous creates globally. You can onboard later from Servers -> the server -> Enroll now.",
+                },
+            ],
+        });
+        if (picked === "anon") {
+            saveServerEntry(url, { ...(existing.token ? {} : { anonymous: true }), label: existing.label, active: true });
+            return { ok: true, message: `Connected to ${url} anonymously - sharing works, no account.`, url };
+        }
+        if (picked === undefined || picked === null)
+            return { ok: false, message: "Cancelled." };
+        // onboard: try without a code (codeless servers), fall through to
+        // the code prompt exactly when the server demands one
+        let code = existing.code ?? "";
+        if (!code) {
+            const free = await enrollAtServer(url, "");
+            if (free.ok) {
+                deactivateOthers();
+                saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined, active: true });
+                return { ok: true, message: `Connected to ${url} as "${free.label}" - sharing goes there now.`, url };
+            }
+            const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
+            if (typed === undefined)
+                return { ok: false, message: "Cancelled - this server needs a code to onboard." };
+            code = typed.trim();
+        }
+        const res = await enrollAtServer(url, code);
+        if (!res.ok)
+            return { ok: false, message: `Enrollment refused: ${res.error}` };
+        deactivateOthers();
+        saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, anonymous: undefined, active: true });
+        return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url };
+    }
+    // private server: a code is required, full stop
+    let code = existing.code ?? "";
+    if (!code) {
+        const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
         if (typed === undefined)
-            return { ok: false, message: "Cancelled — private servers need a code." };
+            return { ok: false, message: "Cancelled - private servers need a code." };
         code = typed.trim();
     }
     const res = await enrollAtServer(url, code);
     if (!res.ok)
         return { ok: false, message: `Enrollment refused: ${res.error}` };
-    // single active server: deactivate the others in the settings home,
-    // then persist the new membership as active
-    for (const other of serverEntries()) {
-        if (other.url !== url)
-            saveServerEntry(other.url, { active: undefined });
-    }
+    deactivateOthers();
     saveServerEntry(url, { token: res.token, label: res.label, code: code || undefined, active: true });
-    return { ok: true, message: `Connected to ${url} as "${res.label}" — sharing goes there now.`, url };
+    return { ok: true, message: `Connected to ${url} as "${res.label}" - sharing goes there now.`, url };
 }
 /** Per-server submenu: identity status + membership actions. Root-token
- * holders get "Get a user token" (admin mints their own user identity —
- * root stays as adminToken; being admin and being a user are NOT mutually
- * exclusive, live-caught). */
+ * holders get "Get a user token" (the admin mints their own user identity;
+ * root stays as adminToken, since being admin and being a user are not
+ * mutually exclusive). */
 async function serverMenu(host, url) {
     while (true) {
         const entries = serverEntries();
@@ -265,7 +320,9 @@ async function serverMenu(host, url) {
                 ? `token ${mask(mine.entry.token)}`
                 : mine.entry.code
                     ? "no token (code saved, enrolls on demand)"
-                    : "no token (public server, enrolls on demand)";
+                    : mine.entry.anonymous
+                        ? "anonymous (declined onboarding)"
+                        : "no token (public server, shares anonymously)";
         const options = [
             { title: url, value: "info", description: `${mine.entry.label ?? "(no label)"} · ${cred}${mine.active ? " · ACTIVE" : ""}`, disabled: true },
         ];
@@ -344,8 +401,20 @@ async function serverMenu(host, url) {
                 continue;
             }
             let code = mine.entry.code ?? "";
-            if (probe.mode === "private" && !code) {
-                const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_… (from the hoster)" });
+            if (!code) {
+                // codeless first: only prompt when the server actually demands
+                // a code (public + codeless-on boards silently, like connect)
+                const free = await enrollAtServer(url, "");
+                if (free.ok) {
+                    saveServerEntry(url, { token: free.token, label: free.label, anonymous: undefined });
+                    host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${free.label}".` });
+                    continue;
+                }
+                if (!/code required/i.test(free.error ?? "")) {
+                    await showInfo(host.ui, { title: "Enrollment refused", message: free.error ?? "unknown error" });
+                    continue;
+                }
+                const typed = await showPrompt(host.ui, { title: `${url} needs an access code`, placeholder: "osc_: (from the hoster)" });
                 if (typed === undefined)
                     continue;
                 code = typed.trim();
@@ -354,7 +423,7 @@ async function serverMenu(host, url) {
             }
             const res = await enrollAtServer(url, code);
             if (res.ok) {
-                saveServerEntry(url, { token: res.token, label: res.label });
+                saveServerEntry(url, { token: res.token, label: res.label, anonymous: undefined });
                 host.ui.toast({ variant: "success", title: "OpenShare", message: `Enrolled as "${res.label}".` });
             }
             else {
@@ -569,9 +638,9 @@ async function withBusy(host, title, work) {
     catch { }
     doneBusy?.();
 }
-/** Server info, the readable version (live-caught: the raw JSON policy line
- * escaped the dialog border): formatted policy lines, auth explained in
- * words, YOUR standing on this server, and follow-up actions. */
+/** Server info, the readable version (the raw JSON policy line escapes
+ * the dialog border): formatted policy lines, auth explained in words,
+ * YOUR standing on this server, and follow-up actions. */
 async function serverInfoScreen(host, url, client) {
     const h = await client.health();
     if (!h.ok) {
@@ -835,16 +904,15 @@ async function adminSharesMenu(host, client, url, shares, users) {
     }
 }
 /** The settings dialog: a compact ROOT of group entries (with live
- * summaries) opening focused submenus. Two-level by design — one flat
- * ~25-row dump was unreadable (owner-directed regroup 2026-10-19).
- * Save semantics unchanged: root Exit saves when dirty; submenu Back
- * just returns. */
+ * summaries) opening focused submenus. Two-level by design: one flat ~25-row
+ * dump is unreadable. Save semantics unchanged: root Exit saves when dirty;
+ * submenu Back just returns. */
 export async function settingsDialog(host, startAtSession, startGroup) {
     let cfg = currentConfig();
     let dirty = false;
-    // Write target (owner rule): global settings home by default; any other
-    // existing file in the read chain may be chosen explicitly. The TUI
-    // never creates deploy-time override files.
+    // Write target: global settings home by default; any other existing
+    // file in the read chain may be chosen explicitly. The TUI never
+    // creates deploy-time override files.
     const candidates = writeCandidates(moduleDir());
     let writeTarget = candidates[0];
     const sources = configSourceMap(moduleDir());
@@ -1004,8 +1072,8 @@ export async function settingsDialog(host, startAtSession, startGroup) {
         rows.push({
             title: "Session TTL override (days)",
             value: "session:ttl",
-            description: binding?.opts?.ttlDays !== undefined ? String(binding.opts.ttlDays) : "(worker default)",
-            help: `Per-session share lifetime. Overrides the config ttlDays for THIS session's pages; still capped by the server's MAX_TTL_DAYS and the token's maxTtlDays. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlDays !== undefined ? `${binding.opts.ttlDays} days` : "(none — config default)"}`,
+            description: binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(worker default)",
+            help: `Per-session share lifetime in HOURS (prompt accepts 6h / 2d / 48). Overrides the config TTL for THIS session's pages; still capped server-side. On a live share it applies immediately (shortening may end an older page at once); otherwise it is used when you share.\n\nCurrent: ${binding?.opts?.ttlHours !== undefined ? fmtHours(binding.opts.ttlHours) : "(none — config default)"}`,
         });
         rows.push({
             title: "Session read auth",
@@ -1220,9 +1288,9 @@ export async function settingsDialog(host, startAtSession, startGroup) {
                             if (!b.server)
                                 continue;
                             // keep id/secret on the opt-out marker: the snapshot stays
-                            // deletable later and re-sharing reuses the binding instead
-                            // of stalling on a secret-less marker (live-caught as "can
-                            // never unshare or re-share after leave-as-is")
+                            // deletable later, and re-sharing reuses the binding instead
+                            // of stalling on a secret-less marker that can never unshare
+                            // or re-share again.
                             servers[b.server] = { ...servers[b.server], id: b.id, secret: b.secret, rev: b.rev, url: b.url, optedOut: true };
                         }
                     });
@@ -1242,28 +1310,35 @@ export async function settingsDialog(host, startAtSession, startGroup) {
                 return;
             }
             if (choice === "session:ttl") {
-                const raw = await showPrompt(host.ui, { title: "Session TTL (days)", placeholder: "days", value: current?.opts?.ttlDays !== undefined ? String(current.opts.ttlDays) : "" });
+                const raw = await showPrompt(host.ui, { title: "Session TTL", placeholder: "hours: 6h, 2d or 48", value: current?.opts?.ttlHours !== undefined ? fmtHours(current.opts.ttlHours) : "" });
                 if (raw === undefined)
                     return;
                 const opts = { ...(current?.opts ?? {}) };
                 if (raw === "")
-                    delete opts.ttlDays;
+                    delete opts.ttlHours;
                 else {
-                    const days = Number(raw);
-                    if (!Number.isFinite(days) || days <= 0) {
-                        host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be a positive number of days." });
+                    const hours = parseTtlHours(raw);
+                    if (hours === undefined) {
+                        host.ui.toast({ variant: "error", title: "OpenShare", message: "TTL must be 6h / 2d style or a positive number of hours." });
                         return;
                     }
-                    opts.ttlDays = Math.floor(days);
+                    opts.ttlHours = hours;
                 }
                 await setShareOpts(host.client, root, opts);
                 const liveNow = live.length > 0;
+                if (liveNow) {
+                    // REST push (#13): immediate on every server, socket or not
+                    const results = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, opts.ttlHours !== undefined ? { ttlHours: opts.ttlHours } : {}, b.secret) : Promise.resolve({ ok: false })));
+                    const failed = results.filter((r) => !r.ok).length;
+                    if (failed)
+                        host.ui.toast({ variant: "error", title: "OpenShare", message: `TTL applied on ${results.length - failed}/${results.length} server(s) - the rest sync on next connect.` });
+                }
                 host.ui.toast({
                     variant: "success",
                     title: "OpenShare",
                     message: liveNow
-                        ? `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
-                        : `Session TTL: ${opts.ttlDays !== undefined ? `${opts.ttlDays}d` : "(default)"} - saved, applies when you share.`,
+                        ? `Session TTL: ${opts.ttlHours !== undefined ? `${fmtHours(opts.ttlHours)} - applied now (shortening may end an older page immediately)` : "(default) - applied now"}.`
+                        : `Session TTL: ${opts.ttlHours !== undefined ? fmtHours(opts.ttlHours) : "(default)"} - saved, applies when you share.`,
                 });
                 return;
             }
@@ -1291,6 +1366,13 @@ export async function settingsDialog(host, startAtSession, startGroup) {
                 }
                 await setShareOpts(host.client, root, opts);
                 const liveNow2 = live.length > 0;
+                if (liveNow2) {
+                    const pair = login === "" ? { authLogin: "", authPassword: "" } : { authLogin: login, authPassword: password };
+                    const results2 = await Promise.all(live.map((b) => b.id && b.secret && b.server ? patchShareOpts(b.server, b.id, pair, b.secret) : Promise.resolve({ ok: false })));
+                    const failed2 = results2.filter((r) => !r.ok).length;
+                    if (failed2)
+                        host.ui.toast({ variant: "error", title: "OpenShare", message: `Read auth applied on ${results2.length - failed2}/${results2.length} server(s) - the rest sync on next connect.` });
+                }
                 host.ui.toast({ variant: "success", title: "OpenShare", message: liveNow2 ? `Read auth ${login === "" ? "removed" : "saved"} - applied now.` : `Read auth ${login === "" ? "cleared" : "saved"} - applies when you share.` });
                 return;
             }
@@ -1340,7 +1422,7 @@ export async function settingsDialog(host, startAtSession, startGroup) {
         });
         groups.push({
             id: "sharing",
-            summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${cfg.ttlDays ?? "server cap"}`,
+            summary: `sync ${seconds(cfg.debounceMs, 10000)} · completed ${seconds(cfg.completedDelayMs, 5000)} · TTL ${fmtHours(cfg.ttlHours ?? 2160)}`,
             help: `What and how sessions stream: share mode (all/manual), sync cadence, the completed-delay, the model label on pages, share TTL, and the viewer's task-tab behavior.\n\nCadence values are clamped by the server's policy window.`,
         });
         groups.push({
@@ -1370,7 +1452,7 @@ export async function settingsDialog(host, startAtSession, startGroup) {
             help: group.help,
         }));
         options.push({ title: dirty ? "Save & exit" : "Exit", value: "action:exit", description: dirty ? `Write ${writeTarget.path}` : "No changes" });
-        const choice = await showSelect(host.ui, { title: "OpenShare settings", options });
+        const choice = await showSelect(host.ui, { title: `OpenShare v${pluginVersion()} · settings`, options });
         if (choice === undefined || choice === "action:exit") {
             if (dirty) {
                 const saved = saveConfig(cfg, writeTarget.path);

package/dist/share-flow.d.ts

@@ -20,11 +20,10 @@ export type SessionBinding = {
 };
 export declare function pluginConfigPaths(baseDir?: string): string[];
 export declare function currentConfig(baseDir?: string): ShareConfig;
-/** Writes the config file. Target rule (owner-directed): the global
- * settings home by default, or an explicit existing file chosen in the
- * TUI — NEVER "first existing in the read chain" (that wrote TUI edits
- * into the tracked adjacent template, live-caught). $comment and foreign
- * keys preserved. */
+/** Writes the config file. Target rule: the global settings home by
+ * default, or an explicit existing file chosen in the TUI, never "first
+ * existing in the read chain" (that writes TUI edits into the tracked
+ * adjacent template). $comment and foreign keys preserved. */
 export declare function saveConfig(cfg: ShareConfig, target?: string, baseDir?: string): {
     path: string;
 } | undefined;
@@ -51,6 +50,11 @@ export declare function readBindings(client: ClientApi | undefined, sid: string)
     server: string;
     collided?: string;
 }>>;
+/** Human TTL from hours: "6h", "2d", "90d" (the TUI prompt accepts
+ * these same shapes back). */
+export declare function fmtHours(hours: number): string;
+/** Parse "6h" / "2d" / "48" into hours (bare number = hours). */
+export declare function parseTtlHours(raw: string): number | undefined;
 export declare function hostOf(url: string): string;
 /** Mutate metadata.openshare.servers[url] through a patcher (TUI per-
  * server actions: opt-out entries, collision resolution). Reads-modifies-
@@ -75,6 +79,18 @@ export declare function setShareFlag(client: ClientApi | undefined, sid: string,
 export declare function setShareOpts(client: ClientApi | undefined, sid: string, opts: SessionOpts): Promise<boolean>;
 export declare function clearShareFlag(client: ClientApi | undefined, sid: string): Promise<boolean>;
 export declare function workerDeleteShare(workerUrl: string, id: string, secret: string): Promise<boolean>;
+/** PATCH a live share's settings over REST (#13): immediate effect with
+ * no socket required (the engine's attach-sync remains the structural
+ * path - this is the same edit pushed now, per server). Auth sends as
+ * the both-or-none pair or not at all; ttlHours only when explicit. */
+export declare function patchShareOpts(workerUrl: string, id: string, opts: {
+    authLogin?: string;
+    authPassword?: string;
+    ttlHours?: number;
+}, secret: string): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
 /** Health probe for the settings dialog's connection test. */
 export declare function probeWorker(workerUrl: string): Promise<{
     ok: boolean;
@@ -336,8 +352,16 @@ export type FlowResult = {
  * informed, not ceremonial. */
 export declare function requestShareConsent(host: ShareHostApi, context?: {
     server?: string;
-    ttlDays?: number;
+    ttlHours?: number;
     auth: boolean;
+    counts?: {
+        messages: number;
+        toolCalls: number;
+    };
+    redaction?: {
+        hits: number;
+        samples: string[];
+    };
 }): Promise<boolean>;
 /** runShareFlow with the consent gate applied: share copies the link,
  * unshared asks consent once, then creates. Every create path routes

package/dist/share-flow.js

@@ -16,7 +16,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { loadConfig, moduleDir, configPaths, configHomePath, resolveServer, saveServerEntry, deleteServerEntry, METADATA_KEY } from "./config.js";
 import { dbg, dbgLog } from "./sidebar.js";
-import { engineTargetUrls } from "./core.js";
+import { engineTargetUrls, sessionStatsFor } from "./core.js";
 import { queueBindingWrite } from "./binding-queue.js";
 export function pluginConfigPaths(baseDir = moduleDir()) {
     return configPaths(baseDir);
@@ -24,11 +24,10 @@ export function pluginConfigPaths(baseDir = moduleDir()) {
 export function currentConfig(baseDir = moduleDir()) {
     return loadConfig(baseDir);
 }
-/** Writes the config file. Target rule (owner-directed): the global
- * settings home by default, or an explicit existing file chosen in the
- * TUI — NEVER "first existing in the read chain" (that wrote TUI edits
- * into the tracked adjacent template, live-caught). $comment and foreign
- * keys preserved. */
+/** Writes the config file. Target rule: the global settings home by
+ * default, or an explicit existing file chosen in the TUI, never "first
+ * existing in the read chain" (that writes TUI edits into the tracked
+ * adjacent template). $comment and foreign keys preserved. */
 export function saveConfig(cfg, target, baseDir = moduleDir()) {
     const path = target ?? configHomePath();
     if (!path)
@@ -53,7 +52,7 @@ export function saveConfig(cfg, target, baseDir = moduleDir()) {
             "debounceMs",
             "completedDelayMs",
             "modelLabel",
-            "ttlDays",
+            "ttlHours",
             "authLogin",
             "authPassword",
             "spoolDir",
@@ -152,6 +151,26 @@ export function bindingsOf(info) {
 export async function readBindings(client, sid) {
     return bindingsOf(await getSession(client, sid));
 }
+/** Human TTL from hours: "6h", "2d", "90d" (the TUI prompt accepts
+ * these same shapes back). */
+export function fmtHours(hours) {
+    if (!Number.isFinite(hours) || hours <= 0)
+        return "?";
+    if (hours % 24 === 0)
+        return `${Math.floor(hours / 24)}d`;
+    return `${Math.floor(hours)}h`;
+}
+/** Parse "6h" / "2d" / "48" into hours (bare number = hours). */
+export function parseTtlHours(raw) {
+    const m = /^\s*(\d+(?:\.\d+)?)\s*(h|d|hr|hours?|days?)?\s*$/i.exec(raw ?? "");
+    if (!m)
+        return undefined;
+    const v = Number(m[1]);
+    if (!Number.isFinite(v) || v <= 0)
+        return undefined;
+    const unit = (m[2] ?? "h").toLowerCase();
+    return Math.max(1, Math.floor(unit.startsWith("d") ? v * 24 : v));
+}
 export function hostOf(url) {
     try {
         return new URL(url).host;
@@ -300,6 +319,32 @@ export async function workerDeleteShare(workerUrl, id, secret) {
         return false;
     }
 }
+/** PATCH a live share's settings over REST (#13): immediate effect with
+ * no socket required (the engine's attach-sync remains the structural
+ * path - this is the same edit pushed now, per server). Auth sends as
+ * the both-or-none pair or not at all; ttlHours only when explicit. */
+export async function patchShareOpts(workerUrl, id, opts, secret) {
+    const body = { secret };
+    if (opts.authLogin !== undefined && opts.authPassword !== undefined) {
+        body.authLogin = opts.authLogin;
+        body.authPassword = opts.authPassword;
+    }
+    if (opts.ttlHours !== undefined)
+        body.ttlHours = opts.ttlHours;
+    try {
+        const res = await fetch(`${workerUrl.replace(/\/$/, "")}/api/share/${id}`, {
+            method: "PATCH",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(8000),
+        });
+        const json = (await res.json().catch(() => ({})));
+        return res.ok && json.ok ? { ok: true } : { ok: false, error: json.error ?? `HTTP ${res.status}` };
+    }
+    catch (e) {
+        return { ok: false, error: e?.message || String(e) };
+    }
+}
 /** Health probe for the settings dialog's connection test. */
 export async function probeWorker(workerUrl) {
     if (!workerUrl)
@@ -518,8 +563,10 @@ export async function requestShareConsent(host, context) {
         const bits = [];
         if (context.server)
             bits.push(`server: ${context.server}`);
-        if (context.ttlDays !== undefined)
-            bits.push(`TTL: ${context.ttlDays}d`);
+        if (context.ttlHours !== undefined)
+            bits.push(`TTL: ${fmtHours(context.ttlHours)}`);
+        if (context.redaction && context.redaction.hits > 0)
+            bits.push(`redaction: ${context.redaction.hits} hit(s)`);
         bits.push(`read auth: ${context.auth ? "on" : "off"}`);
         lines.push(bits.join(" - "));
     }
@@ -554,12 +601,20 @@ export async function shareWithConsent(host, sessionID) {
     }
     const opts = all[0]?.opts;
     const server = serverEntries(cfg).find((s) => s.active) ?? serverEntries(cfg)[0] ?? (engineTargetUrls()[0] ? { url: engineTargetUrls()[0] } : undefined);
-    if (!(await requestShareConsent(host, {
-        server: server ? hostOf(server.url) : undefined,
-        ttlDays: opts?.ttlDays ?? cfg.ttlDays,
-        auth: !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword),
-    })))
-        return { ok: false, message: "Share cancelled." };
+    {
+        const stats = sessionStatsFor(root);
+        const gated = !!(opts?.authLogin ?? cfg.authLogin) && !!(opts?.authPassword ?? cfg.authPassword);
+        if (!(await requestShareConsent(host, {
+            server: server ? hostOf(server.url) : undefined,
+            ttlHours: opts?.ttlHours ?? cfg.ttlHours,
+            auth: gated,
+            counts: { messages: stats.messages, toolCalls: stats.toolCalls },
+            // redaction only runs on ungated shares (a gated share is
+            // private from casual observers; the ledger reflects that)
+            redaction: gated ? undefined : { hits: stats.redaction.count, samples: stats.redaction.samples.map((h) => `${h.sample} [${h.kind}]`) },
+        })))
+            return { ok: false, message: "Share cancelled." };
+    }
     return confirmShare(host, root);
 }
 /** Post-consent share: set the flag, wait for the URL, copy it. */
@@ -580,9 +635,9 @@ export async function confirmShare(host, rootSessionID) {
     const binding = await waitForBinding(host.client, rootSessionID);
     dbgLog(`confirmShare: waitForBinding -> ${binding?.url ? binding.url : "timeout"}`);
     if (!binding?.url) {
-        // a failed create must NOT leave the flag armed - the engine would
-        // publish LATER with no further consent (live-caught). Disarm now;
-        // re-running /share re-consents.
+        // a failed create must NOT leave the flag armed: the engine would
+        // publish LATER with no further consent. Disarm now; re-running
+        // /share re-consents.
         await clearShareFlag(host.client, rootSessionID);
         const fresh = await readBinding(host.client, rootSessionID);
         const why = fresh?.lastError ? `\nReason: ${fresh.lastError}` : "";