agent-canvas 0.1.34 → 0.1.36

package/daemon/src/remote-feedback.ts

@@ -1,5 +1,6 @@
-import type { SessionManager, RemoteFeedbackEntry } from "./session";
+import type { SessionManager, RemoteFeedbackEntry, RemoteAnnotation } from "./session";
 import { loadShareConfig } from "./share";
+import { importShareKey, decryptString } from "../client/shareCrypto";
 
 /**
  * Background polling loop for remote feedback.
@@ -19,12 +20,72 @@ import { loadShareConfig } from "./share";
 const POLL_INTERVAL_MS = 5_000;
 const MAX_BACKOFF_MS = 60_000;
 
+/** Wire-format feedback entry as returned by the worker. When the
+ *  reviewer submitted from an encrypted share their browser ciphertexted
+ *  the secret fields and stamped this with `encryption`; the daemon
+ *  decrypts using the key stashed on the local ShareEntry. */
+interface WireFeedbackEntry {
+  id: string;
+  shareId: string;
+  revision: number;
+  submittedAt: string;
+  author: { id: string; name: string };
+  annotations: Array<{
+    id: string;
+    snippet: string;
+    note: string;
+    createdAt: string;
+    filePath?: string;
+    canvasFile?: string;
+    context?: unknown;
+    attachments?: Array<{ url: string; mime?: string }>;
+  }>;
+  generalNote?: string;
+  encryption?: { alg: string; v: number };
+}
+
 interface WorkerFeedbackResponse {
-  entries: RemoteFeedbackEntry[];
+  entries: WireFeedbackEntry[];
   /** Server-reported high water mark — echo back in the next `since` param */
   latestAt?: string;
 }
 
+/** Decrypt an encrypted-wire feedback entry into the plaintext shape used
+ *  throughout the rest of the daemon. Throws if any field fails to
+ *  decrypt — caller treats that as a transient error so we re-try later. */
+async function decryptFeedbackEntry(entry: WireFeedbackEntry, key: CryptoKey): Promise<RemoteFeedbackEntry> {
+  const annotations: RemoteAnnotation[] = await Promise.all(
+    entry.annotations.map(async (a) => {
+      const out: RemoteAnnotation = {
+        id: a.id,
+        snippet: await decryptString(key, a.snippet),
+        note: await decryptString(key, a.note),
+        createdAt: a.createdAt,
+      };
+      if (a.filePath) out.filePath = await decryptString(key, a.filePath);
+      if (a.canvasFile) out.canvasFile = await decryptString(key, a.canvasFile);
+      if (typeof a.context === "string" && a.context.length > 0) {
+        out.context = JSON.parse(await decryptString(key, a.context));
+      }
+      if (a.attachments) out.attachments = a.attachments;
+      return out;
+    }),
+  );
+
+  return {
+    id: entry.id,
+    shareId: entry.shareId,
+    revision: entry.revision,
+    submittedAt: entry.submittedAt,
+    author: {
+      id: entry.author.id,
+      name: await decryptString(key, entry.author.name),
+    },
+    annotations,
+    ...(entry.generalNote ? { generalNote: await decryptString(key, entry.generalNote) } : {}),
+  };
+}
+
 export function startRemoteFeedbackPoller(
   sessionManager: SessionManager,
   broadcastRemoteFeedback: (sessionId: string, revision: number, entries: RemoteFeedbackEntry[]) => void,
@@ -32,6 +93,18 @@ export function startRemoteFeedbackPoller(
 ): { stop: () => void } {
   let stopped = false;
 
+  // Per-share CryptoKey cache — `importKey` is async and pure given the
+  // same encoded key, so we memoize it for the lifetime of the poller.
+  const keyCache = new Map<string, Promise<CryptoKey>>();
+  function getKey(shareId: string, encoded: string): Promise<CryptoKey> {
+    let cached = keyCache.get(shareId);
+    if (!cached) {
+      cached = importShareKey(encoded);
+      keyCache.set(shareId, cached);
+    }
+    return cached;
+  }
+
   // Per-share consecutive error count → exponential backoff so a dead
   // worker doesn't generate a fire-hose of failed requests.
   const errorCounts = new Map<string, number>();
@@ -41,7 +114,11 @@ export function startRemoteFeedbackPoller(
     return Math.min(MAX_BACKOFF_MS, POLL_INTERVAL_MS * Math.pow(2, errors - 1));
   }
 
-  async function pollShare(sessionId: string, share: { shareId: string; lastFeedbackAt?: string }, endpoint: string) {
+  async function pollShare(
+    sessionId: string,
+    share: { shareId: string; lastFeedbackAt?: string; encryptionKey?: string },
+    endpoint: string,
+  ) {
     try {
       const since = share.lastFeedbackAt ?? "";
       const url = `${endpoint}/shares/${share.shareId}/feedback${since ? `?since=${encodeURIComponent(since)}` : ""}`;
@@ -60,8 +137,31 @@ export function startRemoteFeedbackPoller(
 
       if (!data.entries || data.entries.length === 0) return;
 
-      const byRev = new Map<number, RemoteFeedbackEntry[]>();
+      // Decrypt any entries that came in encrypted. Plaintext entries
+      // (legacy submissions from non-encrypted shares) pass through.
+      const decrypted: RemoteFeedbackEntry[] = [];
       for (const e of data.entries) {
+        if (e.encryption) {
+          if (!share.encryptionKey) {
+            console.warn(`[remote-feedback] ${share.shareId}: received encrypted feedback but no local key — skipping entry ${e.id}`);
+            continue;
+          }
+          try {
+            const key = await getKey(share.shareId, share.encryptionKey);
+            decrypted.push(await decryptFeedbackEntry(e, key));
+          } catch (err: any) {
+            console.warn(`[remote-feedback] ${share.shareId}: failed to decrypt entry ${e.id}: ${err.message || err}`);
+            continue;
+          }
+        } else {
+          decrypted.push(e as RemoteFeedbackEntry);
+        }
+      }
+
+      if (decrypted.length === 0) return;
+
+      const byRev = new Map<number, RemoteFeedbackEntry[]>();
+      for (const e of decrypted) {
         if (!byRev.has(e.revision)) byRev.set(e.revision, []);
         byRev.get(e.revision)!.push(e);
       }

package/daemon/src/session.ts

@@ -78,6 +78,11 @@ export interface ShareEntry {
   expiresAt?: string;
   /** ISO timestamp of the most recent remote feedback we've seen */
   lastFeedbackAt?: string;
+  /** Base64url-encoded AES-GCM key for end-to-end encrypted shares. The
+   *  same key is also embedded in `url` as a `#k=...` fragment so reviewers
+   *  can decrypt; the daemon keeps a copy here so it can decrypt feedback
+   *  it polls back from the worker. Absent on legacy unencrypted shares. */
+  encryptionKey?: string;
 }
 
 export interface SessionData {

package/daemon/src/share-e2e.test.ts

@@ -0,0 +1,277 @@
+/**
+ * End-to-end test: exercises daemon-side encryption + the real worker
+ * fetch handler against in-memory R2/KV stubs, then plays the role of
+ * the browser to decrypt the canvas JS and meta, and finally the role of
+ * a reviewer to submit encrypted feedback and verify the daemon poller
+ * decrypts it back.
+ *
+ * No network, no Miniflare — just direct fetch-handler invocation, which
+ * exercises every production code path except the actual Workers runtime.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+
+import workerHandler from "../../workers/canvas-share/src/index";
+import type { Env } from "../../workers/canvas-share/src/types";
+import { SessionManager } from "./session";
+import { buildSharePayload, encryptSharePayload } from "./share";
+import {
+  generateShareKey,
+  exportShareKey,
+  importShareKey,
+  encryptString,
+  decryptString,
+  ENCRYPTION_META,
+} from "../client/shareCrypto";
+
+// ---- Minimal in-memory R2 / KV stubs ---------------------------------------
+
+function makeR2(): R2Bucket {
+  const store = new Map<string, { body: Uint8Array; contentType?: string }>();
+  return {
+    async put(key: string, value: any, opts?: any) {
+      const bytes = typeof value === "string"
+        ? new TextEncoder().encode(value)
+        : value instanceof Uint8Array
+          ? value
+          : new Uint8Array(await new Response(value).arrayBuffer());
+      store.set(key, { body: bytes, contentType: opts?.httpMetadata?.contentType });
+      return null as any;
+    },
+    async get(key: string) {
+      const v = store.get(key);
+      if (!v) return null;
+      return {
+        body: new Response(v.body).body,
+        async text() { return new TextDecoder().decode(v.body); },
+        async json() { return JSON.parse(new TextDecoder().decode(v.body)); },
+        async arrayBuffer() { return v.body.buffer; },
+        httpMetadata: { contentType: v.contentType },
+      } as any;
+    },
+    async delete(key: string) { store.delete(key); },
+    async list(opts?: any) {
+      const prefix = opts?.prefix ?? "";
+      const objects = [];
+      for (const k of store.keys()) {
+        if (k.startsWith(prefix)) objects.push({ key: k });
+      }
+      return { objects, truncated: false, delimitedPrefixes: [] } as any;
+    },
+  } as unknown as R2Bucket;
+}
+
+function makeKV(): KVNamespace {
+  const store = new Map<string, { value: string; meta?: any; expireAt?: number }>();
+  return {
+    async put(key: string, value: string, opts?: any) {
+      const expireAt = opts?.expirationTtl ? Date.now() + opts.expirationTtl * 1000 : undefined;
+      store.set(key, { value, meta: opts?.metadata, expireAt });
+    },
+    async get(key: string) {
+      const v = store.get(key);
+      if (!v) return null;
+      if (v.expireAt && v.expireAt < Date.now()) { store.delete(key); return null; }
+      return v.value;
+    },
+    async delete(key: string) { store.delete(key); },
+    async list(opts?: any) {
+      const prefix = opts?.prefix ?? "";
+      const keys = [];
+      for (const [k, v] of store.entries()) {
+        if (!k.startsWith(prefix)) continue;
+        if (v.expireAt && v.expireAt < Date.now()) continue;
+        keys.push({ name: k, metadata: v.meta });
+      }
+      return { keys, list_complete: true, cursor: "" } as any;
+    },
+  } as unknown as KVNamespace;
+}
+
+function makeEnv(): Env {
+  return {
+    BLOBS: makeR2(),
+    FEEDBACK: makeKV(),
+    ASSETS: { fetch: async () => new Response("asset", { status: 200 }) } as any,
+  };
+}
+
+// ---- The full flow ---------------------------------------------------------
+
+describe("encrypted share e2e (daemon → worker → browser → reviewer → daemon)", () => {
+  test("round-trips canvas JS, meta, and feedback through the real worker handler", async () => {
+    const testDir = mkdtempSync(join(tmpdir(), "canvas-e2e-"));
+    try {
+      // ----- 1. Daemon side: prepare a session + revision ------------------
+      const sm = new SessionManager(testDir);
+      const sid = "sess-secret-id";
+      const SECRET_LABEL = "Secret quarterly plan";
+      const SECRET_COMPILED = "/* SECRET */ export default function Plan(){ return null; }";
+      const SECRET_JSX = "<Section title='Top secret'>Confidential strategy.</Section>";
+
+      sm.upsert(sid, new Map([["plan.jsx", SECRET_JSX]]), "/tmp", SECRET_LABEL);
+      sm.saveCompiled(sid, "plan.jsx", SECRET_COMPILED);
+
+      // ----- 2. Daemon encrypts the payload --------------------------------
+      const plaintext = buildSharePayload(sm, sid, 1, "1.0.0");
+      const key = await generateShareKey();
+      const encodedKey = await exportShareKey(key);
+      const encryptedPayload = await encryptSharePayload(plaintext, key);
+
+      // ----- 3. POST it to the real worker handler -------------------------
+      const env = makeEnv();
+      const createRes = await workerHandler.fetch(
+        new Request("https://example.com/shares", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(encryptedPayload),
+        }),
+        env,
+      );
+      expect(createRes.status).toBe(200);
+      const created = await createRes.json() as { shareId: string; url: string; ownerToken: string };
+      expect(created.shareId).toMatch(/^[a-f0-9]{24}$/);
+      expect(created.url).toBe(`https://example.com/s/${created.shareId}`);
+
+      // ----- 4. Confirm what's stored in R2 is ciphertext, NOT plaintext ----
+      const storedPayloadObj = await env.BLOBS.get(`shares/${created.shareId}/payload.json`);
+      const storedPayload = JSON.parse(await storedPayloadObj!.text()) as any;
+      expect(storedPayload.encryption).toEqual({ alg: "AES-GCM", v: 1 });
+      expect(storedPayload.origin.sessionId).not.toBe(sid);
+      expect(storedPayload.origin.label).not.toBe(SECRET_LABEL);
+      expect(JSON.stringify(storedPayload)).not.toContain(SECRET_LABEL);
+      expect(JSON.stringify(storedPayload)).not.toContain("SECRET");
+      expect(JSON.stringify(storedPayload)).not.toContain("Confidential");
+
+      const storedCanvasJsObj = await env.BLOBS.get(`shares/${created.shareId}/canvas/plan.js`);
+      const storedCanvasJs = await storedCanvasJsObj!.text();
+      expect(storedCanvasJs).not.toContain("SECRET");
+      expect(storedCanvasJs).not.toContain("function Plan");
+
+      // ----- 5. Browser side: fetch /meta, decrypt origin.label/sessionId --
+      const metaRes = await workerHandler.fetch(
+        new Request(`https://example.com/s/${created.shareId}/meta`),
+        env,
+      );
+      expect(metaRes.status).toBe(200);
+      const meta = await metaRes.json() as any;
+      expect(meta.encryption).toEqual({ alg: "AES-GCM", v: 1 });
+
+      const browserKey = await importShareKey(encodedKey);
+      const decryptedSessionId = await decryptString(browserKey, meta.origin.sessionId);
+      const decryptedLabel = await decryptString(browserKey, meta.origin.label);
+      expect(decryptedSessionId).toBe(sid);
+      expect(decryptedLabel).toBe(SECRET_LABEL);
+
+      // ----- 6. Browser fetches canvas JS and decrypts it -------------------
+      const canvasRes = await workerHandler.fetch(
+        new Request(`https://example.com/s/${created.shareId}/canvas/plan.js`),
+        env,
+      );
+      expect(canvasRes.status).toBe(200);
+      const ciphertextBody = await canvasRes.text();
+      const decryptedJs = await decryptString(browserKey, ciphertextBody);
+      expect(decryptedJs).toBe(SECRET_COMPILED);
+
+      // ----- 7. Reviewer submits encrypted feedback ------------------------
+      const SECRET_NAME = "Dr. Confidential";
+      const SECRET_NOTE = "This section reveals our pricing strategy.";
+      const SECRET_GENERAL = "Overall: please redact slide 3 before sharing further.";
+      const encryptedFeedback = {
+        author: {
+          id: "reviewer-1",
+          name: await encryptString(browserKey, SECRET_NAME),
+        },
+        revision: 1,
+        annotations: [{
+          id: "ann-1",
+          createdAt: "2026-05-18T12:00:00Z",
+          snippet: await encryptString(browserKey, "[Section] Top secret"),
+          note: await encryptString(browserKey, SECRET_NOTE),
+          canvasFile: await encryptString(browserKey, "plan.jsx"),
+        }],
+        generalNote: await encryptString(browserKey, SECRET_GENERAL),
+        encryption: ENCRYPTION_META,
+      };
+
+      const submitRes = await workerHandler.fetch(
+        new Request(`https://example.com/s/${created.shareId}/feedback`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(encryptedFeedback),
+        }),
+        env,
+      );
+      expect(submitRes.status).toBe(200);
+
+      // ----- 8. Confirm KV-stored feedback has no plaintext leakage --------
+      const kvList = await (env.FEEDBACK as any).list({ prefix: `fb:${created.shareId}:` });
+      expect(kvList.keys.length).toBe(1);
+      const kvValueRaw = await env.FEEDBACK.get(kvList.keys[0].name);
+      expect(kvValueRaw).not.toBeNull();
+      expect(kvValueRaw!).not.toContain(SECRET_NAME);
+      expect(kvValueRaw!).not.toContain(SECRET_NOTE);
+      expect(kvValueRaw!).not.toContain(SECRET_GENERAL);
+      expect(kvValueRaw!).not.toContain("plan.jsx");
+
+      // ----- 9. Daemon polls /feedback and decrypts ------------------------
+      const pollRes = await workerHandler.fetch(
+        new Request(`https://example.com/shares/${created.shareId}/feedback`),
+        env,
+      );
+      expect(pollRes.status).toBe(200);
+      const polled = await pollRes.json() as { entries: any[] };
+      expect(polled.entries.length).toBe(1);
+      const wireEntry = polled.entries[0];
+      expect(wireEntry.encryption).toEqual({ alg: "AES-GCM", v: 1 });
+
+      // Daemon-side key (same encodedKey, freshly imported as the poller does)
+      const daemonKey = await importShareKey(encodedKey);
+      const decryptedName = await decryptString(daemonKey, wireEntry.author.name);
+      const decryptedSnippet = await decryptString(daemonKey, wireEntry.annotations[0].snippet);
+      const decryptedNote = await decryptString(daemonKey, wireEntry.annotations[0].note);
+      const decryptedCanvasFile = await decryptString(daemonKey, wireEntry.annotations[0].canvasFile);
+      const decryptedGeneral = await decryptString(daemonKey, wireEntry.generalNote);
+
+      expect(decryptedName).toBe(SECRET_NAME);
+      expect(decryptedSnippet).toBe("[Section] Top secret");
+      expect(decryptedNote).toBe(SECRET_NOTE);
+      expect(decryptedCanvasFile).toBe("plan.jsx");
+      expect(decryptedGeneral).toBe(SECRET_GENERAL);
+
+      // ----- 10. Legacy unencrypted share still works ----------------------
+      const legacyEnv = makeEnv();
+      const legacyCreate = await workerHandler.fetch(
+        new Request("https://example.com/shares", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(plaintext),
+        }),
+        legacyEnv,
+      );
+      expect(legacyCreate.status).toBe(200);
+      const legacy = await legacyCreate.json() as { shareId: string };
+
+      const legacyMeta = await (await workerHandler.fetch(
+        new Request(`https://example.com/s/${legacy.shareId}/meta`),
+        legacyEnv,
+      )).json() as any;
+      expect(legacyMeta.encryption).toBeUndefined();
+      expect(legacyMeta.origin.sessionId).toBe(sid);
+      expect(legacyMeta.origin.label).toBe(SECRET_LABEL);
+
+      const legacyCanvas = await (await workerHandler.fetch(
+        new Request(`https://example.com/s/${legacy.shareId}/canvas/plan.js`),
+        legacyEnv,
+      )).text();
+      expect(legacyCanvas).toBe(SECRET_COMPILED);
+
+      sm.remove(sid);
+    } finally {
+      try { rmSync(testDir, { recursive: true, force: true }); } catch {}
+    }
+  });
+});

package/daemon/src/share.test.ts

@@ -9,7 +9,8 @@ import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "fs";
 import { join } from "path";
 import { tmpdir } from "os";
 import { SessionManager } from "./session";
-import { buildSharePayload, pushShareToWorker, shareRevision, loadShareConfig } from "./share";
+import { buildSharePayload, pushShareToWorker, shareRevision, loadShareConfig, encryptSharePayload } from "./share";
+import { generateShareKey, importShareKey, decryptString } from "../client/shareCrypto";
 
 let testDir: string;
 let originalSessionsDir: string | undefined;
@@ -195,12 +196,16 @@ describe("shareRevision", () => {
     const entry = await shareRevision(sm, sid, 1, {
       endpoint: "https://example.com",
       componentsVersion: "1.0.0",
+      encryption: false,
     });
 
     expect(entry.shareId).toBe("abc123def456");
     expect(entry.revision).toBe(1);
     expect(entry.ownerToken).toBe("owner");
     expect(entry.expiresAt).toBe("2026-12-31T00:00:00Z");
+    // Legacy unencrypted share: no key recorded, no #k= fragment.
+    expect(entry.encryptionKey).toBeUndefined();
+    expect(entry.url).toBe("https://example.com/s/abc123def456");
 
     const shares = sm.getShares(sid);
     expect(shares).toHaveLength(1);
@@ -208,6 +213,76 @@ describe("shareRevision", () => {
 
     sm.remove(sid);
   });
+
+  test("encrypts payload by default and appends #k= fragment to URL", async () => {
+    let captured: any = null;
+    (globalThis as any).fetch = async (_url: any, init: any) => {
+      captured = JSON.parse(init.body);
+      return new Response(JSON.stringify({
+        shareId: "encshareid01",
+        url: "https://example.com/s/encshareid01",
+        ownerToken: "owner",
+      }), { status: 200 });
+    };
+
+    const sm = new SessionManager(testDir);
+    const sid = `enc-${Date.now()}`;
+    sm.upsert(sid, new Map([["plan.jsx", "<Section>hi</Section>"]]), "/tmp", "Secret Label");
+    sm.saveCompiled(sid, "plan.jsx", "/* SECRET-COMPILED */ export default ()=>null");
+
+    const entry = await shareRevision(sm, sid, 1, {
+      endpoint: "https://example.com",
+      componentsVersion: "1.0.0",
+      encryption: true,
+    });
+
+    // Payload going to the worker must be ciphertext, not plaintext.
+    expect(captured.encryption).toEqual({ alg: "AES-GCM", v: 1 });
+    expect(captured.origin.sessionId).not.toBe(sid);
+    expect(captured.origin.label).not.toBe("Secret Label");
+    expect(captured.canvasFiles[0].compiledJs).not.toContain("SECRET-COMPILED");
+    expect(captured.origin.revision).toBe(1); // revision stays plaintext (routing)
+    expect(captured.canvasFiles[0].filename).toBe("plan.jsx"); // filename stays plaintext
+
+    // The URL handed to the user includes the key as a fragment, and the
+    // ShareEntry retains a local copy so the daemon can decrypt feedback.
+    expect(entry.url.startsWith("https://example.com/s/encshareid01#k=")).toBe(true);
+    expect(typeof entry.encryptionKey).toBe("string");
+
+    // Round-trip: import the stored key and confirm it decrypts the
+    // ciphertext that was actually sent to the worker.
+    const key = await importShareKey(entry.encryptionKey!);
+    expect(await decryptString(key, captured.origin.sessionId)).toBe(sid);
+    expect(await decryptString(key, captured.origin.label)).toBe("Secret Label");
+    expect(await decryptString(key, captured.canvasFiles[0].compiledJs)).toContain("SECRET-COMPILED");
+
+    sm.remove(sid);
+  });
+});
+
+describe("encryptSharePayload", () => {
+  test("leaves routing fields plaintext, encrypts secrets", async () => {
+    const key = await generateShareKey();
+    const result = await encryptSharePayload(
+      {
+        version: 1,
+        origin: { sessionId: "sess", revision: 7, label: "lbl", createdAt: "2026-04-09T00:00:00.000Z" },
+        canvasFiles: [
+          { filename: "plan.jsx", compiledJs: "JS-BODY", sourceJsx: "JSX-BODY" },
+        ],
+        runtime: { componentsVersion: "9.9.9" },
+      },
+      key,
+    );
+    expect(result.encryption).toEqual({ alg: "AES-GCM", v: 1 });
+    expect(result.origin.revision).toBe(7);
+    expect(result.origin.createdAt).toBe("2026-04-09T00:00:00.000Z");
+    expect(result.runtime.componentsVersion).toBe("9.9.9");
+    expect(result.canvasFiles[0].filename).toBe("plan.jsx");
+    expect(result.origin.sessionId).not.toBe("sess");
+    expect(result.canvasFiles[0].compiledJs).not.toBe("JS-BODY");
+    expect(result.canvasFiles[0].sourceJsx).not.toBe("JSX-BODY");
+  });
 });
 
 void mkdirSync;

package/daemon/src/share.ts

@@ -1,4 +1,11 @@
 import type { SessionManager, ShareEntry } from "./session";
+import {
+  generateShareKey,
+  exportShareKey,
+  encryptString,
+  ENCRYPTION_META,
+  type EncryptionMeta,
+} from "../client/shareCrypto";
 
 /**
  * Canvas sharing: packages a specific revision into a self-contained
@@ -10,10 +17,25 @@ import type { SessionManager, ShareEntry } from "./session";
  * payload — the worker serves matching runtime from its own deploy, keyed
  * off `runtime.componentsVersion` in the payload. This keeps shares small
  * while still guaranteeing version compatibility.
+ *
+ * End-to-end encryption (default on)
+ * ----------------------------------
+ * Unless `CANVAS_SHARE_ENCRYPTION=off`, each share is encrypted with a
+ * fresh AES-GCM-256 key generated client-side here. The key is embedded
+ * in the returned URL as a `#k=<base64url>` fragment, which browsers do
+ * not transmit to the worker. The worker stores opaque ciphertext and
+ * routing metadata only. The daemon retains the key on `ShareEntry` so it
+ * can also decrypt feedback polled from the worker.
+ *
+ * Legacy unencrypted shares remain supported: the worker accepts both
+ * formats, and the browser detects which one to use based on the URL
+ * fragment.
  */
 
 export interface SharePayload {
   version: 1;
+  /** Present iff payload fields below are ciphertext rather than plaintext. */
+  encryption?: EncryptionMeta;
   origin: {
     sessionId: string;
     revision: number;
@@ -45,6 +67,8 @@ export interface ShareConfig {
   /** Optional bearer token. If the worker has SHARE_AUTH_TOKEN set, this
    *  must match. Loaded from CANVAS_SHARE_AUTH_TOKEN env var on the daemon. */
   authToken?: string;
+  /** End-to-end encryption setting. Defaults to true. */
+  encryption?: boolean;
 }
 
 export function loadShareConfig(version: string): ShareConfig | null {
@@ -53,10 +77,16 @@ export function loadShareConfig(version: string): ShareConfig | null {
   return {
     endpoint: endpoint.replace(/\/+$/, ""),
     componentsVersion: version,
+    encryption: !isEncryptionDisabled(),
     ...(process.env.CANVAS_SHARE_AUTH_TOKEN ? { authToken: process.env.CANVAS_SHARE_AUTH_TOKEN } : {}),
   };
 }
 
+function isEncryptionDisabled(): boolean {
+  const v = (process.env.CANVAS_SHARE_ENCRYPTION ?? "").trim().toLowerCase();
+  return v === "0" || v === "off" || v === "false" || v === "no";
+}
+
 /**
  * Build a SharePayload for the given session/revision. Reads the already
  * compiled JS from the session's revision directory. Also includes the
@@ -101,6 +131,42 @@ export function buildSharePayload(
   };
 }
 
+/**
+ * Encrypt a plaintext SharePayload in-place semantics, returning a new
+ * payload whose secret fields are ciphertext + the `encryption` marker.
+ * Fields kept plaintext (and why):
+ *  - `version`, `runtime.componentsVersion`: routing
+ *  - `origin.revision`, `origin.createdAt`: indexing/display
+ *  - `canvasFiles[].filename`: used as the route key by the worker
+ * Everything else (sessionId, label, compiledJs, sourceJsx) is encrypted.
+ */
+export async function encryptSharePayload(
+  payload: SharePayload,
+  key: CryptoKey,
+): Promise<SharePayload> {
+  const canvasFiles = await Promise.all(
+    payload.canvasFiles.map(async (cf) => ({
+      filename: cf.filename,
+      compiledJs: await encryptString(key, cf.compiledJs),
+      ...(cf.sourceJsx ? { sourceJsx: await encryptString(key, cf.sourceJsx) } : {}),
+    })),
+  );
+  return {
+    version: payload.version,
+    encryption: ENCRYPTION_META,
+    origin: {
+      sessionId: await encryptString(key, payload.origin.sessionId),
+      revision: payload.origin.revision,
+      ...(payload.origin.label
+        ? { label: await encryptString(key, payload.origin.label) }
+        : {}),
+      createdAt: payload.origin.createdAt,
+    },
+    canvasFiles,
+    runtime: payload.runtime,
+  };
+}
+
 /**
  * POST the payload to the CF Worker. Returns the `shareId` + public URL
  * assigned by the worker. Throws on any HTTP error — the caller is expected
@@ -136,8 +202,10 @@ export async function pushShareToWorker(
 }
 
 /**
- * High-level: build payload, push to worker, record the share on the
- * session. Returns the ShareEntry that was recorded.
+ * High-level: build payload, optionally encrypt it, push to worker, record
+ * the share on the session. The URL stored on the ShareEntry includes the
+ * `#k=...` fragment when encryption is on so the user can simply copy &
+ * paste it to reviewers.
  */
 export async function shareRevision(
   sessionManager: SessionManager,
@@ -145,15 +213,28 @@ export async function shareRevision(
   revision: number,
   config: ShareConfig,
 ): Promise<ShareEntry> {
-  const payload = buildSharePayload(sessionManager, sessionId, revision, config.componentsVersion);
+  const plaintext = buildSharePayload(sessionManager, sessionId, revision, config.componentsVersion);
+
+  const useEncryption = config.encryption !== false;
+  let payload = plaintext;
+  let encodedKey: string | undefined;
+  if (useEncryption) {
+    const key = await generateShareKey();
+    encodedKey = await exportShareKey(key);
+    payload = await encryptSharePayload(plaintext, key);
+  }
+
   const response = await pushShareToWorker(payload, config);
+  const url = encodedKey ? `${response.url}#k=${encodedKey}` : response.url;
+
   const entry: ShareEntry = {
     shareId: response.shareId,
-    url: response.url,
+    url,
     revision,
     createdAt: new Date().toISOString(),
     ...(response.ownerToken ? { ownerToken: response.ownerToken } : {}),
     ...(response.expiresAt ? { expiresAt: response.expiresAt } : {}),
+    ...(encodedKey ? { encryptionKey: encodedKey } : {}),
   };
   sessionManager.addShare(sessionId, entry);
   return entry;
@@ -184,4 +265,3 @@ export async function revokeShare(
   }
   sessionManager.removeShare(sessionId, shareId);
 }
-