@saadnvd1/agent-os 0.3.780 → 0.3.781

package/app/api/live-shares/[id]/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { fail, readJson, refuseDemo, toResponse } from "@/lib/share/route";
 import {
   admit,
+  changeCode,
   changeLevel,
   deny,
   dismissSuggestion,
@@ -30,6 +31,13 @@ const Action = z.discriminatedUnion("action", [
     action: z.literal("wheel"),
     guestId: z.string().min(1).max(64).nullable(),
   }),
+  // Sets the access code to the host's own, or turns it off (null).
+  z.object({
+    action: z.literal("code"),
+    code: z.string().max(40).nullable(),
+  }),
+  // Turns the access code on, or changes it, to a generated one.
+  z.object({ action: z.literal("new_code") }),
   z.object({
     action: z.literal("send"),
     suggestionId: z.string().min(1).max(64),
@@ -63,6 +71,9 @@ export async function POST(
     else if (a.action === "kick") kick(id, a.guestId);
     else if (a.action === "level") changeLevel(id, a.level);
     else if (a.action === "wheel") giveWheel(id, a.guestId);
+    else if (a.action === "code")
+      await changeCode(id, a.code === null ? null : { code: a.code });
+    else if (a.action === "new_code") await changeCode(id, { generate: true });
     else if (a.action === "send")
       await sendSuggestion(id, a.suggestionId, a.text);
     else dismissSuggestion(id, a.suggestionId);

package/app/api/live-shares/route.test.ts

@@ -43,6 +43,20 @@ describe("live-shares routes", () => {
     );
   });
 
+  it("validate the access code shape (400) and accept the code actions", async () => {
+    expect(
+      (await POST(req({ sessionId: "s", code: { custom: 5 } }))).status
+    ).toBe(400);
+    expect((await POST(req({ sessionId: "s", code: {} }))).status).toBe(409);
+    expect((await POST(req({ sessionId: "s", code: null }))).status).toBe(409);
+    // A bad own code on a share this machine holds nothing of: 404, so it validated.
+    expect((await act(req({ action: "code", code: "ab" }), ctx)).status).toBe(
+      404
+    );
+    expect((await act(req({ action: "code", code: 5 }), ctx)).status).toBe(400);
+    expect((await act(req({ action: "new_code" }), ctx)).status).toBe(404);
+  });
+
   it("accept watch, suggest and drive, and history as a boolean", async () => {
     // Past validation: not linked to Connect here, so 409, never 400.
     expect((await POST(req({ sessionId: "s", level: "drive" }))).status).toBe(

package/app/api/live-shares/route.ts

@@ -9,6 +9,11 @@ const Create = z.object({
   expiresIn: z.enum(["1h", "session"]).default("1h"),
   level: z.enum(["watch", "suggest", "drive"]).default("suggest"),
   history: z.boolean().default(true),
+  // Absent or null: no code. {} generates one; { custom } uses the host's.
+  code: z
+    .object({ custom: z.string().max(40).optional() })
+    .nullable()
+    .optional(),
 });
 
 // POST /api/live-shares - mint a live link for one chat and start publishing.
@@ -25,7 +30,8 @@ export async function POST(request: Request) {
       body.data.sessionId,
       body.data.expiresIn,
       body.data.level,
-      body.data.history
+      body.data.history,
+      body.data.code
     );
     return NextResponse.json(view, { status: 201 });
   } catch (err) {

package/components/Live/InviteDialog.tsx

@@ -78,10 +78,13 @@ function Create({
   const [expiresIn, setExpiresIn] = useState<LiveExpiry>("1h");
   const [level, setLevel] = useState<LiveLevel>("suggest");
   const [history, setHistory] = useState<boolean | null>(null);
+  const [codeOn, setCodeOn] = useState<boolean | null>(null);
+  const [custom, setCustom] = useState("");
   const create = useCreateLive();
   const options = invite?.levels ?? [];
   const chosen = options.find((o) => o.value === level);
   const withHistory = history ?? invite?.history.default ?? true;
+  const withCode = codeOn ?? invite?.code.default ?? false;
   return (
     <>
       <div className="flex flex-col gap-1.5">
@@ -118,6 +121,36 @@ function Create({
           {invite.history.label}
         </label>
       )}
+      {invite && (
+        <div className="flex flex-col gap-1.5">
+          <label className="flex min-h-11 items-center gap-3 text-sm">
+            <input
+              type="checkbox"
+              className="size-5"
+              checked={withCode}
+              onChange={(e) => setCodeOn(e.target.checked)}
+            />
+            {invite.code.label}
+          </label>
+          {withCode && (
+            <>
+              <input
+                value={custom}
+                onChange={(e) => setCustom(e.target.value)}
+                maxLength={40}
+                autoComplete="off"
+                spellCheck={false}
+                placeholder={invite.code.customLabel}
+                aria-label={invite.code.customLabel}
+                className="bg-muted min-h-11 rounded-lg px-3 font-mono text-sm"
+              />
+              <p className="text-muted-foreground text-xs">
+                {invite.code.hint} {invite.code.rules}
+              </p>
+            </>
+          )}
+        </div>
+      )}
       <div className="flex flex-col gap-1.5">
         <span className="text-muted-foreground text-xs font-medium">
           The link works for
@@ -139,7 +172,17 @@ function Create({
         className="min-h-11"
         disabled={create.isPending}
         onClick={() =>
-          create.mutate({ sessionId, expiresIn, level, history: withHistory })
+          create.mutate({
+            sessionId,
+            expiresIn,
+            level,
+            history: withHistory,
+            code: withCode
+              ? custom.trim()
+                ? { custom: custom.trim() }
+                : {}
+              : null,
+          })
         }
       >
         <Users className="h-4 w-4" />
@@ -153,6 +196,7 @@ function Link({ share }: { share: LiveView }) {
   const { copied, copy } = useCopyToClipboard();
   const end = useEndLive(share.id);
   const qr = useQr(share.url);
+  const code = share.code;
   const canShare = typeof navigator !== "undefined" && "share" in navigator;
   return (
     <>
@@ -175,6 +219,33 @@ function Link({ share }: { share: LiveView }) {
           className="bg-muted min-h-11 w-full rounded-lg px-3 font-mono text-xs"
         />
       </div>
+      {code.on && code.copyText && (
+        <div className="flex flex-col items-center gap-2">
+          <span className="text-muted-foreground text-xs font-medium">
+            {code.label}
+          </span>
+          <span
+            className="font-mono text-3xl font-semibold tracking-widest"
+            aria-label={code.label}
+          >
+            {code.display}
+          </span>
+          <Button
+            className="min-h-11 w-full"
+            onClick={() => copy(code.copyText!)}
+          >
+            {copied ? (
+              <Check className="h-4 w-4" />
+            ) : (
+              <Copy className="h-4 w-4" />
+            )}
+            Copy link and code
+          </Button>
+          <p className="text-muted-foreground text-center text-xs">
+            {code.hint}
+          </p>
+        </div>
+      )}
       <div className="flex flex-wrap gap-2">
         <Button
           variant="outline"
@@ -186,7 +257,7 @@ function Link({ share }: { share: LiveView }) {
           ) : (
             <Copy className="h-4 w-4" />
           )}
-          Copy
+          Copy link
         </Button>
         {canShare && (
           <Button

package/components/Live/LiveChip.tsx

@@ -1,11 +1,12 @@
 "use client";
 
 import { useState } from "react";
-import { ChevronDown, Radio, UserMinus } from "lucide-react";
+import { Check, ChevronDown, Copy, Radio, UserMinus } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { Segmented } from "@/components/ui/segmented";
 import { StatusPill } from "@/components/ui/status-pill";
 import type { LiveLevel, LiveView } from "@/data/live";
+import { useCopyToClipboard } from "@/hooks/useCopyToClipboard";
 import { cn } from "@/lib/utils";
 
 export function presenceText(guests: LiveView["guests"]): string {
@@ -21,6 +22,7 @@ export function LiveChip({
   busy,
   onAction,
   onLevel,
+  onCode,
   onEnd,
   onInvite,
 }: {
@@ -28,6 +30,7 @@ export function LiveChip({
   busy: boolean;
   onAction: (guestId: string, kind: string) => void;
   onLevel: (level: LiveLevel) => void;
+  onCode: (kind: string, own?: string) => void;
   onEnd: () => void;
   onInvite: () => void;
 }) {
@@ -76,6 +79,7 @@ export function LiveChip({
           <p className="text-muted-foreground px-2 text-xs">
             {share.levels.find((o) => o.value === share.level)?.hint}
           </p>
+          <CodeRow share={share} busy={busy} onCode={onCode} />
           {admitted.length === 0 && (
             <p className="text-muted-foreground px-2 py-1 text-xs">
               No one has joined yet.
@@ -128,3 +132,66 @@ export function LiveChip({
     </div>
   );
 }
+
+function CodeRow({
+  share,
+  busy,
+  onCode,
+}: {
+  share: LiveView;
+  busy: boolean;
+  onCode: (kind: string, own?: string) => void;
+}) {
+  const { copied, copy } = useCopyToClipboard();
+  const { code } = share;
+  const change = (kind: string) => {
+    if (kind === "copy") copy(code.copyText ?? share.url);
+    else if (kind === "copy_link") copy(share.url);
+    else if (kind === "set_code") {
+      const own = window.prompt(`${code.prompt.title}\n${code.prompt.message}`);
+      if (own?.trim()) onCode(kind, own.trim());
+    } else onCode(kind);
+  };
+  return (
+    <div className="flex flex-col gap-1 px-2 py-1">
+      <div className="flex min-h-11 items-center gap-2">
+        <span className="text-muted-foreground text-xs">{code.label}</span>
+        <span className="min-w-0 flex-1 truncate font-mono text-sm font-semibold tracking-wider">
+          {code.on ? code.display : "Off"}
+        </span>
+        {code.on && code.copyText && (
+          <Button
+            variant="ghost"
+            className="min-h-11"
+            onClick={() => copy(code.copyText!)}
+            aria-label="Copy link and code"
+          >
+            {copied ? (
+              <Check className="h-4 w-4" />
+            ) : (
+              <Copy className="h-4 w-4" />
+            )}
+          </Button>
+        )}
+      </div>
+      {code.notice && (
+        <p className="text-muted-foreground text-xs">{code.notice}</p>
+      )}
+      <div className="flex flex-wrap gap-1">
+        {code.actions
+          .filter((a) => a.kind !== "copy" && a.kind !== "copy_link")
+          .map((a) => (
+            <Button
+              key={a.kind}
+              variant="ghost"
+              className="min-h-11"
+              disabled={busy}
+              onClick={() => change(a.kind)}
+            >
+              {a.label}
+            </Button>
+          ))}
+      </div>
+    </div>
+  );
+}

package/components/Live/LivePanel.tsx

@@ -47,6 +47,14 @@ export function LivePanel({
         onLevel={(level) =>
           act.mutate({ action: "level", level }, { onError: fail })
         }
+        onCode={(kind, own) => {
+          if (kind === "code_off")
+            act.mutate({ action: "code", code: null }, { onError: fail });
+          else if (kind === "set_code" && own)
+            act.mutate({ action: "code", code: own }, { onError: fail });
+          else if (kind === "new_code" || kind === "code_on")
+            act.mutate({ action: "new_code" }, { onError: fail });
+        }}
         onEnd={() => end.mutate(undefined, { onError: fail })}
         onInvite={() => liveUiActions.open(sessionId, title)}
       />

package/data/live/queries.ts

@@ -57,6 +57,7 @@ export function useCreateLive() {
       expiresIn: LiveExpiry;
       level: LiveLevel;
       history: boolean;
+      code?: { custom?: string } | null;
     }) => json<LiveView>(await send("/api/live-shares", "POST", req)),
     onSuccess: () => qc.invalidateQueries({ queryKey: liveKeys.all }),
   });
@@ -67,6 +68,8 @@ export type LiveAction =
   | { action: "deny" | "kick"; guestId: string }
   | { action: "wheel"; guestId: string | null }
   | { action: "level"; level: LiveLevel }
+  | { action: "code"; code: string | null }
+  | { action: "new_code" }
   | { action: "send"; suggestionId: string; text?: string }
   | { action: "dismiss"; suggestionId: string };
 

package/lib/connect/control-api.ts

@@ -482,13 +482,20 @@ export interface LiveShare {
   expires_at: string | null;
   ends_with_session: boolean;
   max_guests: number;
+  /** Connect confirmed it holds an access code for the share. */
+  access_code: boolean;
 }
 
 /** Mints a live link for one session; the answer carries the link, once. */
 export async function createLiveShare(
   config: ConnectConfig,
   privateKey: string,
-  share: { title: string; expiresIn: LiveExpiry; access?: string }
+  share: {
+    title: string;
+    expiresIn: LiveExpiry;
+    access?: string;
+    accessCode?: string;
+  }
 ): Promise<LiveShare> {
   const res = await signed(config, privateKey)(
     "POST",
@@ -497,6 +504,7 @@ export async function createLiveShare(
       title: share.title,
       expires_in: share.expiresIn,
       ...(share.access ? { access: share.access } : {}),
+      ...(share.accessCode ? { access_code: share.accessCode } : {}),
     }
   );
   const r = (await res.json().catch(() => null)) as Record<
@@ -517,5 +525,26 @@ export async function createLiveShare(
     expires_at: typeof r.expires_at === "string" ? r.expires_at : null,
     ends_with_session: r.ends_with_session === true,
     max_guests: typeof r.max_guests === "number" ? r.max_guests : 0,
+    access_code: r.access_code === true,
   };
 }
+
+/** Sets (a code) or clears (null) a live share's access code; Connect must say it did. */
+export async function setLiveAccessCode(
+  config: ConnectConfig,
+  privateKey: string,
+  id: string,
+  code: string | null
+): Promise<void> {
+  if (!/^[a-z0-9]{12}$/.test(id)) throw new Error("not a share id");
+  const res = await signed(config, privateKey)(
+    "PUT",
+    `/api/v1/machines/${config.machineId}/live-shares/${id}/access-code`,
+    { access_code: code }
+  );
+  const r = (await res.json().catch(() => null)) as {
+    access_code?: unknown;
+  } | null;
+  if (r?.access_code !== (code !== null))
+    throw new Error("the Connect service did not confirm the access code");
+}

package/lib/db/migrations/20261031T1200_live_share_access_code.ts

@@ -0,0 +1,14 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261031T1200_live_share_access_code",
+  up: (db) => {
+    const cols = (
+      db.prepare(`PRAGMA table_info(live_shares)`).all() as { name: string }[]
+    ).map((c) => c.name);
+    // Null is off. The code is kept in plain text so the host can see it again;
+    // Connect holds only a keyed hash of it.
+    if (!cols.includes("access_code"))
+      db.exec(`ALTER TABLE live_shares ADD COLUMN access_code TEXT`);
+  },
+} satisfies Migration;

package/lib/live/code-view.ts

@@ -0,0 +1,56 @@
+import type { LiveCodeView, LiveInvite } from "./types";
+import { displayCode } from "./code";
+import type { Runtime } from "./runtime";
+
+const HINT =
+  "Guests type this before they reach your lobby. You still let each one in.";
+
+const RULES = "6 to 32 letters or digits.";
+
+/** The access code block of a share, with the actions it offers right now. */
+export function codeView(rt: Runtime, now = Date.now()): LiveCodeView {
+  const code = rt.share.access_code;
+  const locked = rt.codeLockedUntil && rt.codeLockedUntil > now;
+  return {
+    on: !!code,
+    display: code ? displayCode(code) : null,
+    copyText: code
+      ? `${rt.share.url}\nAccess code: ${displayCode(code)}`
+      : null,
+    label: "Access code",
+    hint: HINT,
+    notice:
+      code && locked
+        ? `Too many wrong codes. New guests can join again at ${new Date(
+            rt.codeLockedUntil!
+          ).toLocaleTimeString([], {
+            hour: "numeric",
+            minute: "2-digit",
+          })}, or change the code now.`
+        : null,
+    prompt: {
+      title: "Use my own code",
+      message: RULES,
+      placeholder: "Your code",
+    },
+    actions: code
+      ? [
+          { kind: "copy", label: "Copy link and code" },
+          { kind: "copy_link", label: "Copy link" },
+          { kind: "new_code", label: "New code" },
+          { kind: "set_code", label: "Use my own…" },
+          { kind: "code_off", label: "Turn off" },
+        ]
+      : [{ kind: "code_on", label: "Turn on" }],
+  };
+}
+
+export function inviteCode(): LiveInvite["code"] {
+  return {
+    default: false,
+    label: "Require an access code",
+    hint: HINT,
+    customLabel: "Use my own code",
+    rules: RULES,
+  };
+}

package/lib/live/code.ts

@@ -0,0 +1,25 @@
+import crypto from "crypto";
+
+/** The code is never logged, so nothing here prints it. */
+
+/** Six digits, zero-padded so 123 is "000123". */
+export function generateCode(): string {
+  return String(crypto.randomInt(0, 1_000_000)).padStart(6, "0");
+}
+
+/** The shape Connect checks: spaces and dashes dropped, upper-cased. */
+export function normalizeCode(code: string): string {
+  return code.replace(/[\s-]/g, "").toUpperCase();
+}
+
+/** Why a host's own code is refused, or null when it's fine. */
+export function codeRefusal(code: string): string | null {
+  return /^[A-Z0-9]{6,32}$/.test(normalizeCode(code))
+    ? null
+    : "The access code must be 6 to 32 letters or digits.";
+}
+
+/** What the host sees and copies: "482-917" for six digits, else as typed in capitals. */
+export function displayCode(code: string): string {
+  return /^\d{6}$/.test(code) ? `${code.slice(0, 3)}-${code.slice(3)}` : code;
+}

package/lib/live/inbox.ts

@@ -35,6 +35,7 @@ export const DOWNWARD = [
   "access_failed",
   "drive_prompt",
   "drive_stop",
+  "code_locked",
 ] as const;
 
 const id = z.string().min(1).max(64);
@@ -55,6 +56,7 @@ const SCHEMAS = {
   access_failed: z.object({ reason: z.string().max(200).optional() }),
   drive_prompt: z.object({ id, guest, text: z.string().max(16000) }),
   drive_stop: z.object({ id, guest }),
+  code_locked: z.object({ until: z.string().max(40) }),
 } satisfies Record<(typeof DOWNWARD)[number], z.ZodType>;
 
 export interface InboxEffects {
@@ -225,6 +227,13 @@ export function handleFrame(
       }
       return true;
     }
+    case "code_locked": {
+      const until = Date.parse(
+        (parsed.data as z.infer<typeof SCHEMAS.code_locked>).until
+      );
+      rt.codeLockedUntil = Number.isFinite(until) ? until : null;
+      return true;
+    }
     case "drive_prompt":
       return acceptPrompt(
         rt,

package/lib/live/runtime.ts

@@ -48,6 +48,8 @@ export interface Runtime {
   flushTimer: ReturnType<typeof setTimeout> | null;
   slowUntil: number;
   notice: string | null;
+  /** Connect locked the lobby until this time (ms) after wrong access codes. */
+  codeLockedUntil: number | null;
   drops: number;
   drive: DriveState;
 }

package/lib/live/service.ts

@@ -10,7 +10,12 @@ import { addTap, getSession, registry } from "../chat/registry";
 import { sendChatConfirmed } from "../chat/runner";
 import { shareContext } from "../share/context";
 import { redactForShare } from "../share/redact";
-import { ShareError, createLiveRemote, revokeRemote } from "../share/connect";
+import {
+  ShareError,
+  createLiveRemote,
+  revokeRemote,
+  setAccessCodeRemote,
+} from "../share/connect";
 import type { LiveExpiry } from "../connect/control-api";
 import {
   LEVELS,
@@ -19,6 +24,8 @@ import {
   type LiveView,
 } from "./types";
 import { driveView, guestActions, levelOptions } from "./levels";
+import { codeView, inviteCode } from "./code-view";
+import { codeRefusal, generateCode, normalizeCode } from "./code";
 import {
   driveRefusal,
   newDrive,
@@ -45,6 +52,7 @@ import {
   logLive,
   markLiveEnded,
   openSuggestions,
+  setAccessCode,
   setLevel,
   type LiveShareRow,
 } from "./store";
@@ -108,6 +116,7 @@ function attach(row: LiveShareRow): Runtime {
     flushTimer: null,
     slowUntil: 0,
     notice: null,
+    codeLockedUntil: null,
     drops: 0,
     drive: newDrive(row.id),
   };
@@ -162,7 +171,8 @@ export async function createLive(
   sessionId: string,
   expiresIn: LiveExpiry,
   level: LiveLevel = "suggest",
-  history = true
+  history = true,
+  codeOpt?: { custom?: string } | null
 ): Promise<LiveView> {
   startLive();
   const session = getSession(sessionId);
@@ -170,13 +180,36 @@ export async function createLive(
     throw new ShareError(`Drive: ${driveRefusal(session)}.`, 400);
   if (activeLiveShareFor(sessionId))
     throw new ShareError("This session already has a live link.", 409);
+  let accessCode: string | null = null;
+  if (codeOpt) {
+    if (codeOpt.custom) {
+      const why = codeRefusal(codeOpt.custom);
+      if (why) throw new ShareError(why, 400);
+    }
+    accessCode = codeOpt.custom
+      ? normalizeCode(codeOpt.custom)
+      : generateCode();
+  }
   const ctx = shareContext();
   const title =
     redactForShare(session.name, ctx)
       .text.replace(/\s+/g, " ")
       .trim()
       .slice(0, 120) || "Chat";
-  const made = await createLiveRemote({ title, expiresIn, access: level });
+  const made = await createLiveRemote({
+    title,
+    expiresIn,
+    access: level,
+    ...(accessCode ? { accessCode } : {}),
+  });
+  // An old Connect ignores the code and would let anyone reach the lobby.
+  if (accessCode && !made.access_code) {
+    await revokeRemote(made.id).catch(() => {});
+    throw new ShareError(
+      "Connect doesn't support access codes yet. Try again without one.",
+      502
+    );
+  }
   const row: LiveShareRow = {
     id: made.id,
     session_id: sessionId,
@@ -189,6 +222,7 @@ export async function createLive(
     ended_at: null,
     level,
     history: history ? 1 : 0,
+    access_code: accessCode,
   };
   insertLiveShare(row);
   attach(row);
@@ -216,6 +250,30 @@ export function changeLevel(id: string, level: LiveLevel): void {
   live.socket?.send(id, "access", { level });
 }
 
+/**
+ * Turns the access code on (generate, or the host's own), changes it, or turns
+ * it off (null). Connect first: if it doesn't confirm, nothing changes here.
+ * Guests already in or waiting keep their seat; only new joins need the code.
+ */
+export async function changeCode(
+  id: string,
+  next: { generate: true } | { code: string } | null
+): Promise<void> {
+  const rt = runtimeFor(id);
+  let code: string | null = null;
+  if (next && "code" in next) {
+    const why = codeRefusal(next.code);
+    if (why) throw new ShareError(why, 400);
+    code = normalizeCode(next.code);
+  } else if (next) code = generateCode();
+  await setAccessCodeRemote(id, code);
+  const now = live.runtimes.get(id);
+  if (!now || now.share.ended_at) return;
+  now.share = { ...now.share, access_code: code };
+  setAccessCode(id, code);
+  now.codeLockedUntil = null;
+}
+
 /** Gives the wheel to an admitted guest of a Drive share, or takes it back (null). */
 export function giveWheel(id: string, guestId: string | null): void {
   const rt = runtimeFor(id);
@@ -253,6 +311,7 @@ export function inviteFor(sessionId: string): LiveInvite {
       default: true,
       count,
     },
+    code: inviteCode(),
   };
 }
 
@@ -413,6 +472,7 @@ export function viewOf(id: string, now = Date.now()): LiveView | null {
     notice: rt.notice,
     level: rt.share.level,
     levels,
+    code: codeView(rt, now),
     history: rt.share.history === 1,
     ...driveView(rt),
     guests: shown

package/lib/live/store.ts

@@ -14,6 +14,8 @@ export interface LiveShareRow {
   level: LiveLevel;
   /** 1: guests get the chat from before the link was made. */
   history: number;
+  /** The access code in plain text, or null when off. Never logged. */
+  access_code: string | null;
 }
 
 export type LogKind =
@@ -25,6 +27,8 @@ export type LogKind =
   | "sent"
   | "dismissed"
   | "level"
+  // The code was turned on, off or changed; the log never holds the code.
+  | "code_changed"
   // Drive: who holds the wheel (guest_id, ref = the wheel's own id; both
   // null when taken back), a prompt they sent (ref = its id), and why a
   // Drive's turn or queue was stopped (ref = the reason).
@@ -47,8 +51,8 @@ export interface LogRow {
 export function insertLiveShare(row: LiveShareRow): void {
   db.prepare(
     `INSERT INTO live_shares
-       (id, session_id, title, url, ends_with_session, max_guests, created_at, expires_at, ended_at, level, history)
-     VALUES (@id, @session_id, @title, @url, @ends_with_session, @max_guests, @created_at, @expires_at, @ended_at, @level, @history)`
+       (id, session_id, title, url, ends_with_session, max_guests, created_at, expires_at, ended_at, level, history, access_code)
+     VALUES (@id, @session_id, @title, @url, @ends_with_session, @max_guests, @created_at, @expires_at, @ended_at, @level, @history, @access_code)`
   ).run(row);
 }
 
@@ -94,6 +98,22 @@ export function setLevel(id: string, level: LiveLevel): void {
   });
 }
 
+export function setAccessCode(id: string, code: string | null): void {
+  db.prepare(`UPDATE live_shares SET access_code = ? WHERE id = ?`).run(
+    code,
+    id
+  );
+  logLive({
+    share_id: id,
+    kind: "code_changed",
+    guest_id: null,
+    guest_name: null,
+    ref: code ? "on" : "off",
+    text: null,
+    sent_text: null,
+  });
+}
+
 export function logLive(
   row: Omit<LogRow, "id" | "at"> & { at?: number }
 ): void {

package/lib/live/types.ts

@@ -29,6 +29,25 @@ export interface GuestAction {
   label: string;
 }
 
+export type CodeActionKind =
+  "copy" | "copy_link" | "new_code" | "set_code" | "code_off" | "code_on";
+
+/** The access code as the host's screens show it; built on the machine. */
+export interface LiveCodeView {
+  on: boolean;
+  /** "482-917", or the host's own code in capitals. Null when off. */
+  display: string | null;
+  /** The link and the code on two lines, for one paste. Null when off. */
+  copyText: string | null;
+  label: string;
+  hint: string;
+  /** Set after too many wrong tries; a code change clears it. */
+  notice: string | null;
+  /** For "Use my own". */
+  prompt: { title: string; message: string; placeholder: string };
+  actions: { kind: CodeActionKind; label: string }[];
+}
+
 export type DriverState = "idle" | "queued" | "working" | "waiting_on_host";
 
 // What the host's screens show of a live share (served by /api/live-shares).
@@ -46,6 +65,7 @@ export interface LiveView {
   levels: LevelOption[];
   /** Whether the guests got the chat from before the link was made. */
   history: boolean;
+  code: LiveCodeView;
   /** The guest holding the wheel on a Drive share. */
   driver: { guestId: string; name: string; state: DriverState } | null;
   /** Shown above the composer while a guest drives. */
@@ -81,6 +101,13 @@ export const EXPIRY_LABEL: Record<LiveExpiry, string> = {
 export interface LiveInvite {
   levels: LevelOption[];
   history: { label: string; default: boolean; count: number };
+  code: {
+    default: boolean;
+    label: string;
+    hint: string;
+    customLabel: string;
+    rules: string;
+  };
 }
 
 export interface LiveResponse {

package/lib/share/connect.ts

@@ -7,6 +7,7 @@ import {
   listShares,
   replaceShare,
   createLiveShare,
+  setLiveAccessCode,
   revokeShare,
   uploadShare,
   type LiveExpiry,
@@ -112,6 +113,7 @@ export async function createLiveRemote(share: {
   title: string;
   expiresIn: LiveExpiry;
   access?: string;
+  accessCode?: string;
 }) {
   const { config, machineKey } = files();
   try {
@@ -120,3 +122,21 @@ export async function createLiveRemote(share: {
     explain(err);
   }
 }
+
+/** Puts a new access code on Connect (null turns it off). Throws if Connect doesn't confirm. */
+export async function setAccessCodeRemote(
+  id: string,
+  code: string | null
+): Promise<void> {
+  const { config, machineKey } = files();
+  try {
+    await setLiveAccessCode(config, machineKey, id, code);
+  } catch (err) {
+    if (err instanceof ApiError && (err.status === 404 || err.status === 410))
+      throw new ShareError("This link has ended.", 404);
+    throw new ShareError(
+      "Connect didn't confirm the access code, so it is unchanged. Try again.",
+      502
+    );
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.780",
+  "version": "0.3.781",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"