@saadnvd1/agent-os 0.3.558 → 0.3.561

package/lib/plans/release.ts

@@ -8,7 +8,7 @@ import { loadProjectConfig } from "../project-config";
 import { createTask } from "../tasks";
 import { startOrQueue } from "../tasks/queue";
 import { braked, BrakeRefused } from "../orchestrator/brakes";
-import { queueEvent } from "../orchestrator/events";
+import { queueEvent, queueEventOnce } from "../orchestrator/events";
 import { amendBrief } from "../orchestrator/amendments";
 import { usageRows } from "../session-logs/gather";
 import { pieceBrief } from "./pieces";
@@ -190,7 +190,8 @@ async function releaseOne(
     )
     .run((piece.session_id ??= randomUUID()), piece.id).changes;
   if (!claimed) return;
-  const prompt = `[Feature "${feature.name}", piece ${piece.position} of ${all.length}, started by AgentOS from an approved plan]\n${pieceBrief(all.length, { position: piece.position, name: piece.name, slice: piece.slice, owns: piece.owns ? piece.owns.split(", ") : [] }, planPathOf(feature.id), beforeLines(all, piece.position))}`;
+  const project = getProject(piece.project_id);
+  const prompt = `[Feature "${feature.name}", piece ${piece.position} of ${all.length}, started by AgentOS from an approved plan]\n${pieceBrief(all.length, { position: piece.position, name: piece.name, slice: piece.slice, owns: piece.owns ? piece.owns.split(", ") : [] }, planPathOf(feature.id), beforeLines(all, piece.position), project?.name)}`;
   try {
     const id = await deps.start(feature, piece, prompt, piece.session_id);
     if (id !== piece.session_id)
@@ -246,16 +247,56 @@ function close(feature: Feature, all: FeaturePiece[], deps: ReleaseDeps): void {
     )
     .run(cost, ended > started ? ended - started : null, feature.id).changes;
   if (!claimed) return;
+  // A plan that listed more than it built is told, not closed quietly.
+  const listed = feature.listed ?? live.length;
+  const left = [
+    feature.folded ? `folded: ${feature.folded.split("\n").join("; ")}` : "",
+    all.some((p) => p.status === "dropped")
+      ? `dropped: ${all
+          .filter((p) => p.status === "dropped")
+          .map((p) => p.name)
+          .join(", ")}`
+      : "",
+  ].filter(Boolean);
+  const short =
+    listed > live.length || left.length
+      ? ` Its plan listed ${listed}; check the rest landed (${left.join("; ") || "not built as pieces"}).`
+      : "";
   say(
     feature,
     `done-${feature.id}`,
-    `Feature "${feature.name}" is merged: ${live.length} ${live.length === 1 ? "PR" : "PRs"}.`
+    `Feature "${feature.name}" is merged: ${live.length} ${live.length === 1 ? "PR" : "PRs"}.${short}`
   );
   deps.pushFeatureMerged(feature);
 }
 
+// A dependency merged and the piece after it still hasn't started: the sweep
+// that should have started it is stuck, or the start keeps being held.
+export const STUCK_PIECE_MS = 30 * 60 * 1000;
+
+function stuckPieces(feature: Feature, all: FeaturePiece[], now: number): void {
+  for (const piece of all) {
+    if (piece.status !== "waiting" || !piece.after_position) continue;
+    const dep = all.find((p) => p.position === piece.after_position);
+    const merged = dep ? sessionOf(dep.session_id)?.merged_at : null;
+    if (!dep || dep.status !== "merged" || !merged) continue;
+    const since = Date.parse(`${merged}Z`);
+    const wait =
+      piece.after_kind === "deployed" ? STUCK_PIECE_MS * 2 : STUCK_PIECE_MS;
+    if (now - since < wait) continue;
+    queueEventOnce(
+      feature.workspace_id,
+      `feature:stuck-${piece.id}-${since}`,
+      feature.plan_session_id,
+      `Feature "${feature.name}": piece ${piece.position} ${piece.name} is still waiting ${Math.floor((now - since) / 60000)}m after ${dep.position} ${dep.name} merged. Release it anyway or drop it.`,
+      now
+    );
+  }
+}
+
 export async function releasePieces(
-  deps: ReleaseDeps = realDeps
+  deps: ReleaseDeps = realDeps,
+  now = Date.now()
 ): Promise<void> {
   const features = db
     .prepare(`SELECT * FROM features WHERE status = 'building'`)
@@ -267,6 +308,7 @@ export async function releasePieces(
       await releaseOne(feature, piecesOf(feature.id), piece, deps).catch((e) =>
         console.error(`[features] piece ${piece.id}:`, e)
       );
+    stuckPieces(feature, piecesOf(feature.id), now);
     close(feature, piecesOf(feature.id), deps);
   }
 }

package/lib/recipes/settle.ts

@@ -459,6 +459,9 @@ export function startSettling(): void {
     busy = true;
     void settleRuns()
       .then(() => releasePieces())
+      .then(async () =>
+        (await import("../orchestrator/reconcile")).reconcileSweep()
+      )
       .catch((e) => console.error("[recipes] settle:", e))
       .finally(() => {
         busy = false;

package/lib/security/demo.ts

@@ -65,6 +65,7 @@ export const STATIC_SIBLINGS = [
   "me",
   "items",
   "network",
+  "preview",
   "queue",
   "status",
 ];

package/lib/session-audit/normalize.ts

@@ -9,7 +9,7 @@ import { redact } from "../orchestrator/untrusted";
 /** Tokens a text costs, by the usual 4 characters a token. An estimate. */
 export const estTokens = (chars: number) => Math.ceil(chars / 4);
 
-const HOME = /\/(?:Users|home)\/[^/\s"']+/g;
+export const HOME = /\/(?:Users|home)\/[^/\s"']+/g;
 const WORKTREE = /~\/\.agent-os\/worktrees\/[^/\s"']+/g;
 const ORCH_DIR = /~\/\.agent-os\/orchestrators\/[^/\s"']+/g;
 const TMP = /\/(?:private\/)?(?:var\/folders|tmp)\/[^\s"']*/g;

package/lib/settings-url.ts

@@ -10,6 +10,7 @@ export const SETTINGS_SECTIONS = [
   "workspaces",
   "models",
   "devices",
+  "shares",
   "notifications",
   "recipes",
   "schedules",

package/lib/share/connect.ts

@@ -0,0 +1,86 @@
+/** Connect's share API, answered in terms the dialog can act on. */
+
+import { loadConnect } from "@/lib/connect/config";
+import {
+  ApiError,
+  clean,
+  listShares,
+  revokeShare,
+  uploadShare,
+  type RemoteShare,
+  type ShareExpiry,
+} from "@/lib/connect/control-api";
+
+export const NOT_LINKED = "Link this machine to Connect to share a link.";
+
+export class ShareError extends Error {
+  constructor(
+    message: string,
+    readonly status: number
+  ) {
+    super(message);
+  }
+}
+
+export const linked = () => loadConnect() !== null;
+
+function files() {
+  const f = loadConnect();
+  if (!f) throw new ShareError(NOT_LINKED, 409);
+  return f;
+}
+
+/** A failed call as a message that says what to do next. */
+function explain(err: unknown): never {
+  if (err instanceof ShareError) throw err;
+  if (err instanceof ApiError) {
+    if (err.status === 413)
+      throw new ShareError(
+        `Connect refused it as too big or over your quota: ${clean(err.message, 120)}`,
+        413
+      );
+    if (err.status === 429)
+      throw new ShareError(
+        "Too many shares just now. Try again in a few minutes.",
+        429
+      );
+    if (err.status === 401 || err.status === 403)
+      throw new ShareError(
+        "Connect doesn't accept this machine. Link it again in Settings → Devices & access.",
+        502
+      );
+    if (err.status === 404) throw new ShareError("Not found on Connect.", 404);
+    throw new ShareError(clean(err.message, 120), 502);
+  }
+  throw new ShareError("Couldn't reach Connect. Try again in a moment.", 502);
+}
+
+export async function createRemote(share: {
+  kind: "chat" | "artifact";
+  title: string;
+  html: string;
+  expiresIn: ShareExpiry;
+}) {
+  const { config, machineKey } = files();
+  try {
+    return await uploadShare(config, machineKey, share);
+  } catch (err) {
+    explain(err);
+  }
+}
+
+export async function listRemote(): Promise<RemoteShare[]> {
+  const { config, machineKey } = files();
+  return listShares(config, machineKey);
+}
+
+/** Revokes on Connect; a share Connect no longer has counts as revoked. */
+export async function revokeRemote(id: string): Promise<void> {
+  const { config, machineKey } = files();
+  try {
+    await revokeShare(config, machineKey, id);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) return;
+    explain(err);
+  }
+}

package/lib/share/context.ts

@@ -0,0 +1,50 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import type { ShareContext } from "./redact";
+
+// Environment variables that hold a credential, by name.
+const SECRET_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CREDENTIALS?|AUTH)/;
+const NOT_SECRET_NAME = /(SOCK|_FILE|_PATH|_DIR)$/;
+const USERINFO_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@\s/]+@/i;
+
+export function envSecrets(env: NodeJS.ProcessEnv = process.env): string[] {
+  const out = new Set<string>();
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || value.length < 8) continue;
+    const named = SECRET_NAME.test(name) && !NOT_SECRET_NAME.test(name);
+    if (named || (name.endsWith("_URL") && USERINFO_URL.test(value)))
+      out.add(value);
+  }
+  return [...out];
+}
+
+/** Host and HostName entries of an ssh config, wildcards left out. */
+export function sshHosts(config: string): string[] {
+  const out = new Set<string>();
+  for (const line of config.split("\n")) {
+    const m = line.match(/^\s*(?:Host|HostName)\s+(.+?)\s*$/i);
+    if (!m) continue;
+    for (const h of m[1].split(/\s+/))
+      if (!/[*?!]/.test(h) && !/^\d+\.\d+\.\d+\.\d+$/.test(h)) out.add(h);
+  }
+  return [...out];
+}
+
+/** This machine's details, read once per request. Every read fails soft. */
+export function shareContext(): ShareContext {
+  const home = os.homedir();
+  let user = "";
+  try {
+    user = os.userInfo().username;
+  } catch {
+    user = process.env.USER ?? "";
+  }
+  const hostname = os.hostname();
+  let ssh = "";
+  try {
+    ssh = fs.readFileSync(path.join(home, ".ssh", "config"), "utf8");
+  } catch {}
+  const hosts = [hostname, hostname.split(".")[0], ...sshHosts(ssh)];
+  return { home, user, secrets: envSecrets(), hosts };
+}

package/lib/share/redact.ts

@@ -0,0 +1,190 @@
+/**
+ * What a shared snapshot must not carry: credentials, the machine's paths,
+ * addresses and names, and email addresses. Pure: everything about this
+ * machine comes in through the context (lib/share/context), so the rules can
+ * be tested with invented values.
+ *
+ * Public hostnames (github.com) are left alone on purpose: masking every
+ * domain would destroy ordinary content. Only names that identify the
+ * reader's own machines and network are masked.
+ */
+
+import {
+  PRIVATE_KEY_BLOCK,
+  SECRET_ASSIGNMENT,
+  SECRET_PARAM,
+  SECRET_TOKENS,
+  URL_USERINFO,
+  BASE64_RUN,
+  looksRandom,
+} from "@/lib/orchestrator/untrusted";
+import { HOME } from "@/lib/session-audit/normalize";
+
+export type Kind = "secret" | "path" | "ip" | "host" | "email";
+export type Hits = Record<Kind, number>;
+export const noHits = (): Hits => ({
+  secret: 0,
+  path: 0,
+  ip: 0,
+  host: 0,
+  email: 0,
+});
+export const addHits = (a: Hits, b: Hits): Hits => ({
+  secret: a.secret + b.secret,
+  path: a.path + b.path,
+  ip: a.ip + b.ip,
+  host: a.host + b.host,
+  email: a.email + b.email,
+});
+
+export interface ShareContext {
+  /** The user's home directory. */
+  home: string;
+  /** The OS account name. */
+  user: string;
+  /** Values of secret-looking environment variables, masked wherever they appear. */
+  secrets: string[];
+  /** This machine's names, and the hosts its ssh config knows. */
+  hosts: string[];
+}
+
+export const NO_CONTEXT: ShareContext = {
+  home: "",
+  user: "",
+  secrets: [],
+  hosts: [],
+};
+
+const SECRET = "[secret]";
+const BEARER = /(\bbearer\s+)(?!\[secret\])[A-Za-z0-9._~+/=-]{8,}/gi;
+const INLINE_ASSIGNMENT =
+  /(\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CREDENTIALS?|AUTH)[A-Z0-9_]*=)(?!\[secret\])[^\s'"]+/g;
+const LONG_HEX = /\b[a-fA-F0-9]{40,}\b/g;
+
+const IPV4 =
+  /(?<![\w.])(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)(?![\w.]*\w)/g;
+const KEEP_IPV4 = new Set(["127.0.0.1", "0.0.0.0"]);
+const G = "[0-9a-f]{1,4}";
+// Eight groups, or a "::" compression; a lone "12:30:45" is a time, not this.
+const IPV6 = new RegExp(
+  `(?<![\\w:])(?:(?:${G}:){7}${G}|(?:${G}:){1,7}:(?:${G}(?::${G}){0,6})?|::(?:${G}(?::${G}){0,6})?)(?![\\w:])`,
+  "gi"
+);
+const KEEP_IPV6 = new Set(["::1", "::"]);
+
+const LOCAL_HOST =
+  /\b(?:[a-z0-9][a-z0-9-]*\.)+(?:ts\.net|local|lan|internal|home\.arpa)\b/gi;
+const CONNECT_HOST = /\bm-[0-9a-f]{16}\.runagentos\.com\b/gi;
+const EMAIL = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+\b/g;
+
+const escape = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/** A replacement that counts what it replaced. */
+function sub(
+  text: string,
+  re: RegExp,
+  to: string | ((m: string, ...g: string[]) => string),
+  hits: Hits,
+  kind: Kind,
+  keep?: (m: string) => boolean
+): string {
+  return text.replace(re, (m: string, ...g: string[]) => {
+    if (keep?.(m)) return m;
+    hits[kind]++;
+    return typeof to === "function" ? to(m, ...g) : to;
+  });
+}
+
+export function redactForShare(
+  input: string,
+  ctx: ShareContext = NO_CONTEXT
+): { text: string; hits: Hits } {
+  const hits = noHits();
+  let t = input;
+
+  // 1. Credentials by shape.
+  t = sub(t, PRIVATE_KEY_BLOCK, SECRET, hits, "secret");
+  t = sub(
+    t,
+    SECRET_ASSIGNMENT,
+    (_m, k) => `${k}${SECRET}`,
+    hits,
+    "secret",
+    (m) => m.endsWith(SECRET)
+  );
+  t = sub(t, INLINE_ASSIGNMENT, (_m, k) => `${k}${SECRET}`, hits, "secret");
+  t = sub(t, BEARER, (_m, k) => `${k}${SECRET}`, hits, "secret");
+  t = sub(
+    t,
+    URL_USERINFO,
+    (_m, s) => `${s}${SECRET}@`,
+    hits,
+    "secret",
+    (m) => m.endsWith(`${SECRET}@`)
+  );
+  t = sub(
+    t,
+    SECRET_PARAM,
+    (_m, k) => `${k}${SECRET}`,
+    hits,
+    "secret",
+    (m) => m.endsWith(SECRET)
+  );
+  for (const re of SECRET_TOKENS) t = sub(t, re, SECRET, hits, "secret");
+  t = sub(t, LONG_HEX, SECRET, hits, "secret");
+  t = sub(t, BASE64_RUN, SECRET, hits, "secret", (m) => !looksRandom(m));
+
+  // 2. This machine's own secrets, wherever they appear.
+  for (const value of ctx.secrets) {
+    if (value.length < 8 || !t.includes(value)) continue;
+    const parts = t.split(value);
+    hits.secret += parts.length - 1;
+    t = parts.join(SECRET);
+  }
+
+  // 3. Home paths, and the account name before an @.
+  if (ctx.home.length > 1)
+    t = sub(
+      t,
+      new RegExp(escape(ctx.home) + "(?![\\w.-])", "g"),
+      "~",
+      hits,
+      "path"
+    );
+  t = sub(t, new RegExp(HOME.source, "g"), "~", hits, "path");
+  if (ctx.user.length > 2)
+    t = sub(
+      t,
+      new RegExp(`\\b${escape(ctx.user)}(?=@)`, "g"),
+      "user",
+      hits,
+      "path"
+    );
+
+  // 4. Addresses.
+  t = sub(t, IPV4, "[ip]", hits, "ip", (m) => KEEP_IPV4.has(m));
+  t = sub(t, IPV6, "[ip]", hits, "ip", (m) => KEEP_IPV6.has(m));
+
+  // 5. This machine's names, and private-network suffixes.
+  const names = [...new Set(ctx.hosts.filter((h) => h.length > 2))].sort(
+    (a, b) => b.length - a.length
+  );
+  if (names.length)
+    t = sub(
+      t,
+      new RegExp(
+        `(?<![\\w.-])(?:${names.map(escape).join("|")})(?![\\w-])`,
+        "gi"
+      ),
+      "[host]",
+      hits,
+      "host"
+    );
+  t = sub(t, CONNECT_HOST, "[host]", hits, "host");
+  t = sub(t, LOCAL_HOST, "[host]", hits, "host");
+
+  // 6. Email addresses.
+  t = sub(t, EMAIL, "[email]", hits, "email");
+
+  return { text: t, hits };
+}

package/lib/share/render.tsx

@@ -0,0 +1,161 @@
+/**
+ * A snapshot as one self-contained HTML page: inline CSS, no script, no
+ * request on load. Output depends only on (snapshot, sharedAt), so what the
+ * preview showed is byte-for-byte what gets uploaded.
+ *
+ * Markdown goes through react-markdown with raw HTML off (the default: do
+ * not add rehype-raw), so nothing a message says becomes markup.
+ */
+
+import { isValidElement, type ReactNode } from "react";
+import { renderToStaticMarkup } from "./static-markup";
+import ReactMarkdown, { type Components } from "react-markdown";
+import remarkGfm from "remark-gfm";
+import { Prism as Highlighter } from "react-syntax-highlighter";
+import type { Snapshot, SnapshotItem } from "./snapshot";
+import { STYLES } from "./styles";
+
+export const MAX_SHARE_BYTES = 5 * 1024 * 1024;
+
+const escape = (s: string) =>
+  s
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+
+const METAS = `<meta name="robots" content="noindex,nofollow"><meta name="referrer" content="no-referrer"><meta name="color-scheme" content="light dark">`;
+
+function textOf(node: ReactNode): string {
+  if (typeof node === "string" || typeof node === "number") return String(node);
+  if (Array.isArray(node)) return node.map(textOf).join("");
+  if (isValidElement<{ children?: ReactNode }>(node))
+    return textOf(node.props.children);
+  return "";
+}
+
+const components: Components = {
+  pre: ({ children }) => <>{children}</>,
+  code({ className, children }) {
+    const language = className?.match(/language-([\w+-]+)/)?.[1];
+    const text = textOf(children);
+    if (!language && !text.includes("\n")) return <code>{children}</code>;
+    return (
+      <Highlighter
+        language={language ?? "text"}
+        useInlineStyles={false}
+        PreTag="pre"
+        CodeTag="code"
+      >
+        {text.replace(/\n$/, "")}
+      </Highlighter>
+    );
+  },
+  a: ({ href, children }) => (
+    <a href={href} target="_blank" rel="noopener noreferrer">
+      {children}
+    </a>
+  ),
+  // A remote image would phone home when the page is opened.
+  img: ({ alt }) => <span>[image{alt ? `: ${alt}` : ""}]</span>,
+};
+
+function Markdown({ text }: { text: string }) {
+  return (
+    <ReactMarkdown remarkPlugins={[remarkGfm]} components={components}>
+      {text}
+    </ReactMarkdown>
+  );
+}
+
+function Item({ item }: { item: SnapshotItem }) {
+  switch (item.type) {
+    case "user":
+      return (
+        <div className="msg user">
+          <div className="bubble">{item.text}</div>
+        </div>
+      );
+    case "assistant":
+      return (
+        <div className="msg assistant">
+          <Markdown text={item.text} />
+        </div>
+      );
+    case "plan":
+      return (
+        <div className="msg plan">
+          <div className="kicker">Plan</div>
+          <Markdown text={item.text} />
+        </div>
+      );
+    case "error":
+      return <div className="msg error">{item.text}</div>;
+    case "divider":
+      return <div className="msg divider">{item.text}</div>;
+    case "artifact":
+      return (
+        <div className="msg artifact">
+          <div className="kicker">{item.label}</div>
+          <iframe
+            sandbox="allow-scripts"
+            referrerPolicy="no-referrer"
+            loading="lazy"
+            title={item.label}
+            style={{ height: item.height ?? 480 }}
+            srcDoc={withMetas(item.html ?? "")}
+          />
+        </div>
+      );
+    case "detail":
+      return (
+        <details className="msg tool">
+          <summary>{item.label}</summary>
+          <pre>{item.text}</pre>
+        </details>
+      );
+  }
+}
+
+export function renderChatSnapshot(
+  snapshot: Snapshot,
+  opts: { sharedAt: string }
+): string {
+  const body = renderToStaticMarkup(
+    <>
+      {snapshot.items.map((item) => (
+        <Item key={item.id} item={item} />
+      ))}
+    </>
+  );
+  const date = opts.sharedAt.slice(0, 10);
+  const note = snapshot.toolsHidden
+    ? " · Read-only snapshot; tool calls hidden"
+    : " · Read-only snapshot";
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">${METAS}<title>${escape(snapshot.title)}</title><style>${STYLES}</style></head><body><div class="wrap"><header><h1 class="title">${escape(snapshot.title)}</h1><p class="meta">Shared from AgentOS · ${escape(date)}${note}</p></header><main>${body}</main><footer>Made with <a href="https://github.com/saadnvd1/agent-os" target="_blank" rel="noopener noreferrer">AgentOS</a></footer></div></body></html>`;
+}
+
+/** An artifact's page with the privacy metas added to its head. */
+export function withMetas(html: string): string {
+  if (/<head[\s>]/i.test(html))
+    return html.replace(/<head(\s[^>]*)?>/i, (m) => m + METAS);
+  if (/<html[\s>]/i.test(html))
+    return html.replace(
+      /<html(\s[^>]*)?>/i,
+      (m) => `${m}<head>${METAS}</head>`
+    );
+  return `<!doctype html><html><head><meta charset="utf-8">${METAS}</head><body>${html}</body></html>`;
+}
+
+export function renderArtifactSnapshot(html: string, title: string): string {
+  const page = withMetas(html);
+  return /<title[\s>]/i.test(page)
+    ? page
+    : page.replace(
+        /<head(\s[^>]*)?>/i,
+        (m) => `${m}<title>${escape(title)}</title>`
+      );
+}
+
+export const tooBig = (html: string) =>
+  Buffer.byteLength(html, "utf8") > MAX_SHARE_BYTES;

package/lib/share/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { demoMode } from "@/lib/security/demo";
+import { readCapped } from "@/lib/security/read-capped";
+import { BadShare } from "./service";
+import { ShareError } from "./connect";
+
+const MAX_BODY = 64 * 1024;
+
+export const fail = (error: string, status: number) =>
+  NextResponse.json({ error }, { status });
+
+export const refuseDemo = () =>
+  demoMode() ? fail("Not in the demo.", 403) : null;
+
+/** The JSON body, capped, or a response saying why not. */
+export async function readJson(
+  request: Request
+): Promise<{ body: unknown } | { refused: NextResponse }> {
+  const text = await readCapped(request, MAX_BODY);
+  if (text === null) return { refused: fail("Request too large.", 413) };
+  try {
+    return { body: text ? JSON.parse(text) : {} };
+  } catch {
+    return { refused: fail("Invalid JSON.", 400) };
+  }
+}
+
+export function toResponse(err: unknown): NextResponse {
+  if (err instanceof BadShare || err instanceof ShareError)
+    return fail(err.message, err.status);
+  console.error(`share: ${(err as Error)?.message ?? err}`);
+  return fail("Couldn't share that.", 500);
+}