agent-yes 1.175.0 → 1.176.0

package/ts/agentShare.ts

@@ -0,0 +1,330 @@
+// Single-agent, view-only shares (Option X from docs/agent-sharing.md).
+//
+// A scoped share stands up its OWN e2ee WebRTC room (via startShare, minted
+// fresh — never the persisted master fleet room) that exposes exactly ONE agent,
+// read-only. The room's host bridge wraps the full `ay serve` API handler in a
+// `scopedFetch` that DEFAULT-DENIES and permits only read paths, each verified to
+// resolve to the shared `agent_id` (the stable per-process id, not the reusable
+// pid). Read-only is enforced here on the host — the browser hiding controls is
+// only UX (design principle #1: host-enforced capability, not client-side hiding).
+//
+// Link format: agent-yes.com/w/#room:grantSecret — the pid is NOT in the URL; the
+// scope lives in this host-side share record. Shares are ephemeral (no disk
+// persistence): a daemon restart drops them, and a restarted agent mints a fresh
+// agent_id, so the holder re-shares (a deliberate NON-GOAL per the design).
+import { listRecords, resolveOne, type CommonOpts } from "./subcommands.ts";
+import { startShare } from "./share.ts";
+
+export type SharePerm = "r" | "rw";
+
+export interface ScopedShare {
+  shareId: string;
+  agentId: string;
+  perm: SharePerm;
+  room: string;
+  link: string;
+  label: string; // human hint: cli · cwd basename
+  createdAt: number;
+  expiresAt: number;
+  close: () => void;
+}
+
+// Bound concurrent shares: each is its own signaling WS + WebRTC host peer with a
+// process.exit self-heal on repeated native peer-setup failure (see ts/share.ts),
+// so a fleet of rooms multiplies that risk and the signaling-DO cost. A handful is
+// plenty for the intended "show someone this one agent" use.
+export const MAX_SHARES = 8;
+export const DEFAULT_SHARE_TTL_MS = 24 * 60 * 60 * 1000; // 24h — design "short expiration"
+
+const shares = new Map<string, ScopedShare>();
+
+function lsOpts(all = false): CommonOpts {
+  return { all, active: false, json: true, latest: true, cwdScope: null };
+}
+
+export function listShares(): Omit<ScopedShare, "close">[] {
+  return [...shares.values()]
+    .sort((a, b) => b.createdAt - a.createdAt)
+    .map(({ close: _close, ...s }) => s);
+}
+
+export function revokeShare(shareId: string): boolean {
+  const s = shares.get(shareId);
+  if (!s) return false;
+  try {
+    s.close();
+  } catch {
+    /* already closed */
+  }
+  shares.delete(shareId);
+  return true;
+}
+
+export function revokeAllShares(): void {
+  for (const id of [...shares.keys()]) revokeShare(id);
+}
+
+/** Resolve a keyword to a live agent and mint a fresh view-only share room for it. */
+export async function createScopedShare(opts: {
+  agent: string; // any keyword: pid, agent_id, cwd/cli/prompt substring
+  perm?: SharePerm;
+  localFetch: (req: Request) => Promise<Response>;
+  apiToken: string;
+  sighost?: string;
+  ttlMs?: number;
+}): Promise<Omit<ScopedShare, "close">> {
+  if (shares.size >= MAX_SHARES) {
+    throw new Error(`too many active shares (max ${MAX_SHARES}) — revoke one first`);
+  }
+  const record = await resolveOne(opts.agent, lsOpts(true)); // throws if none match
+  const agentId = record.agent_id;
+  if (!agentId) {
+    // Only agents registered with a stable id can be scoped safely; pid alone is
+    // reused and unsafe as the security key.
+    throw new Error(`agent ${record.pid} has no stable agent_id — cannot share (restart it)`);
+  }
+  const label = `${record.cli}${record.cwd ? " · " + record.cwd.split("/").filter(Boolean).pop() : ""}`;
+
+  const scoped = scopedFetch(agentId, opts.localFetch, opts.perm ?? "r");
+  const { room, link, close } = await startShare({
+    localFetch: scoped,
+    apiToken: opts.apiToken,
+    sighost: opts.sighost,
+    // no `url` → startShare mints a fresh, unpersisted room (never the master room)
+  });
+
+  const shareId = "s" + Math.abs(hashStr(room + agentId + link)).toString(36);
+  const createdAt = Date.now();
+  const ttl = opts.ttlMs ?? DEFAULT_SHARE_TTL_MS;
+  const expiresAt = createdAt + ttl;
+
+  const stop = () => close();
+  const expiryTimer = setTimeout(() => revokeShare(shareId), ttl);
+  expiryTimer.unref?.();
+
+  const share: ScopedShare = {
+    shareId,
+    agentId,
+    perm: opts.perm ?? "r",
+    room,
+    link,
+    label,
+    createdAt,
+    expiresAt,
+    close: () => {
+      clearTimeout(expiryTimer);
+      stop();
+    },
+  };
+  shares.set(shareId, share);
+  const { close: _c, ...pub } = share;
+  return pub;
+}
+
+function hashStr(s: string): number {
+  let h = 0;
+  for (let i = 0; i < s.length; i++) h = (Math.imul(31, h) + s.charCodeAt(i)) | 0;
+  return h;
+}
+
+function forbidden(msg = "read-only share"): Response {
+  return new Response(msg, { status: 403 });
+}
+
+// Wrap the master API handler so a scoped viewer can ONLY read, and only THIS
+// agent. Default-deny: an endpoint not explicitly allowed below is 403.
+export function scopedFetch(
+  agentId: string,
+  inner: (req: Request) => Promise<Response>,
+  perm: SharePerm = "r",
+): (req: Request) => Promise<Response> {
+  return async (req: Request): Promise<Response> => {
+    const url = new URL(req.url);
+    const p = url.pathname;
+    const method = req.method;
+
+    // Static host metadata, no agent data.
+    if (method === "GET" && p === "/api/version") return inner(req);
+    if (method === "GET" && p === "/api/whoami")
+      return withShareFlag(await inner(req), agentId, perm);
+
+    // Agent list: force keyword=agentId (cheap server-side narrowing) then
+    // post-filter by EXACT agent_id — matchKeyword can fuzzy-match a sibling whose
+    // cwd/prompt contains the hex, so the keyword hint is not a boundary on its own.
+    if (method === "GET" && (p === "/api/ls" || p === "/api/ls/subscribe")) {
+      const scopedUrl = new URL(url);
+      scopedUrl.searchParams.set("keyword", agentId);
+      scopedUrl.searchParams.delete("all"); // never widen to other/exited agents
+      const scopedReq = new Request(scopedUrl.toString(), req);
+      const res = await inner(scopedReq);
+      return p === "/api/ls" ? filterLsJson(res, agentId) : filterLsSse(res, agentId);
+    }
+
+    // Per-agent reads — verify the target resolves to OUR agent_id (403 otherwise).
+    const m =
+      /^\/api\/(read|tail|status|size)\/(.+)$/.exec(p) && method === "GET"
+        ? /^\/api\/(read|tail|status|size)\/(.+)$/.exec(p)
+        : null;
+    if (m) {
+      const kw = decodeURIComponent(m[2]!);
+      if (!(await targetIsAgent(kw, agentId))) return forbidden("agent not shared");
+      return inner(req);
+    }
+
+    // Steer (rw): a read-WRITE share may drive THIS agent — send input, resize its
+    // PTY, and self-report presence. It still may NOT control it (kill/restart/
+    // spawn are machine-admin, excluded from a per-agent share) nor touch any other
+    // agent. Treat `send` as command-injection-equivalent — the warning shown when
+    // minting an rw link is the real safety gate (docs/agent-sharing.md).
+    if (perm.includes("w")) {
+      // POST /api/send  body {keyword, msg, code} — verify the target is us.
+      if (method === "POST" && p === "/api/send") {
+        let kw: unknown;
+        try {
+          kw = JSON.parse(await req.clone().text())?.keyword;
+        } catch {
+          return forbidden("bad body");
+        }
+        if (kw == null || !(await targetIsAgent(String(kw), agentId)))
+          return forbidden("agent not shared");
+        return inner(req);
+      }
+      // POST /api/resize/:kw — verify the target is us.
+      const rz = method === "POST" ? /^\/api\/resize\/(.+)$/.exec(p) : null;
+      if (rz) {
+        const kw = decodeURIComponent(rz[1]!);
+        if (!(await targetIsAgent(kw, agentId))) return forbidden("agent not shared");
+        return inner(req);
+      }
+      // POST /api/presence — cosmetic "who's watching" self-report, no agent control.
+      if (method === "POST" && p === "/api/presence") return inner(req);
+    }
+
+    // Everything else (kill, restart, spawn, notes, spawn-config, share*, …, and —
+    // for a view-only share — send/resize/presence too) is denied.
+    return forbidden();
+  };
+}
+
+async function targetIsAgent(keyword: string, agentId: string): Promise<boolean> {
+  try {
+    const rec = await resolveOne(keyword, lsOpts(true));
+    return rec.agent_id === agentId;
+  } catch {
+    return false;
+  }
+}
+
+// Add a self-describing read-only capability to /api/whoami so the viewer console
+// can enter read-only UI. The host stays the real boundary (writes are 403'd
+// regardless); this is a UX hint the browser can trust because it comes from the
+// host over the same e2ee channel.
+async function withShareFlag(res: Response, agentId: string, perm: SharePerm): Promise<Response> {
+  if (!res.ok) return res;
+  let body: unknown;
+  try {
+    body = await res.json();
+  } catch {
+    return res;
+  }
+  const obj = body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  return Response.json({ ...obj, share: { perm, agent_id: agentId, readonly: perm === "r" } });
+}
+
+async function filterLsJson(res: Response, agentId: string): Promise<Response> {
+  if (!res.ok) return res;
+  let arr: unknown;
+  try {
+    arr = await res.json();
+  } catch {
+    return res;
+  }
+  const kept = Array.isArray(arr)
+    ? arr.filter(
+        (r) => r && typeof r === "object" && (r as { agent_id?: string }).agent_id === agentId,
+      )
+    : [];
+  return Response.json(kept, { status: res.status });
+}
+
+// Filter the /api/ls/subscribe SSE so only the shared agent's deltas cross the
+// channel. Each event is `{full?, upsert:[records], remove:[pids]}`; keep only
+// upserts whose agent_id matches, and only removes for pids we actually forwarded.
+function filterLsSse(res: Response, agentId: string): Response {
+  if (!res.ok || !res.body) return res;
+  const reader = res.body.getReader();
+  const dec = new TextDecoder();
+  const enc = new TextEncoder();
+  const forwarded = new Set<number>();
+  let buf = "";
+
+  const stream = new ReadableStream({
+    async pull(ctrl) {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+          ctrl.close();
+          return;
+        }
+        buf += dec.decode(value, { stream: true });
+        // Emit each complete SSE event (blank-line separated).
+        let sep: number;
+        let emittedSomething = false;
+        while ((sep = buf.indexOf("\n\n")) !== -1) {
+          const rawEvent = buf.slice(0, sep);
+          buf = buf.slice(sep + 2);
+          const out = transformEvent(rawEvent, agentId, forwarded);
+          if (out !== null) {
+            ctrl.enqueue(enc.encode(out + "\n\n"));
+            emittedSomething = true;
+          }
+        }
+        if (emittedSomething) return; // yield to the consumer; resume on next pull
+      }
+    },
+    cancel() {
+      reader.cancel().catch(() => {});
+    },
+  });
+  return new Response(stream, {
+    status: res.status,
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}
+
+// Returns the rewritten SSE event text, or null to drop it entirely. Passes
+// through comment lines (": ping" heartbeats) and non-data frames unchanged.
+function transformEvent(rawEvent: string, agentId: string, forwarded: Set<number>): string | null {
+  const trimmed = rawEvent.replace(/\r/g, "");
+  if (!trimmed.trim()) return null;
+  if (!/^data:/m.test(trimmed)) return trimmed; // comments/heartbeats pass through
+  // Reassemble the `data:` payload (SSE allows multiple data: lines per event).
+  const dataLines = trimmed
+    .split("\n")
+    .filter((l) => l.startsWith("data:"))
+    .map((l) => l.slice(5).replace(/^ /, ""));
+  const payload = dataLines.join("\n");
+  let obj: {
+    full?: boolean;
+    upsert?: { pid: number; agent_id?: string }[];
+    remove?: number[];
+  };
+  try {
+    obj = JSON.parse(payload);
+  } catch {
+    return null; // malformed — drop rather than leak
+  }
+  const upsert = (obj.upsert ?? []).filter((r) => r && r.agent_id === agentId);
+  for (const r of upsert) forwarded.add(r.pid);
+  const remove = (obj.remove ?? []).filter((pid) => forwarded.has(pid));
+  for (const pid of remove) forwarded.delete(pid);
+  // On the first snapshot always emit (even if empty) so the viewer knows it's
+  // connected; later ticks only when something relevant changed.
+  if (!obj.full && upsert.length === 0 && remove.length === 0) return null;
+  const next = obj.full ? { full: true, upsert, remove } : { upsert, remove };
+  return "data: " + JSON.stringify(next);
+}

package/ts/forkNested.spec.ts

@@ -1,5 +1,8 @@
-import { describe, expect, it } from "vitest";
-import { buildSpawnTutorial, shouldForkNested } from "./forkNested";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import path from "path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { buildSpawnTutorial, shouldForkNested, waitForFifo } from "./forkNested";
 
 describe("shouldForkNested", () => {
   it("forks when nested (AGENT_YES_PID set) and stdout is not a TTY", () => {
@@ -21,6 +24,40 @@ describe("shouldForkNested", () => {
   });
 });
 
+describe("waitForFifo", () => {
+  let home: string;
+  let prevHome: string | undefined;
+
+  beforeEach(() => {
+    home = mkdtempSync(path.join(tmpdir(), "ay-forknested-"));
+    mkdirSync(path.join(home, "fifo"), { recursive: true });
+    prevHome = process.env.AGENT_YES_HOME;
+    process.env.AGENT_YES_HOME = home;
+  });
+
+  afterEach(() => {
+    if (prevHome === undefined) delete process.env.AGENT_YES_HOME;
+    else process.env.AGENT_YES_HOME = prevHome;
+    rmSync(home, { recursive: true, force: true });
+  });
+
+  it("resolves true as soon as the wrapper's stdin FIFO is registered", async () => {
+    // Register the endpoint a poll-tick after the wait starts, like a real spawn.
+    setTimeout(() => writeFileSync(path.join(home, "fifo", "111.stdin"), ""), 60);
+    await expect(waitForFifo(111, 2000)).resolves.toBe(true);
+  });
+
+  it("times out false when the child never registers", async () => {
+    await expect(waitForFifo(222, 120)).resolves.toBe(false);
+  });
+
+  it("fails fast when aborted() reports the child already died", async () => {
+    const start = Date.now();
+    await expect(waitForFifo(333, 5000, () => true)).resolves.toBe(false);
+    expect(Date.now() - start).toBeLessThan(1000); // no full-timeout wait
+  });
+});
+
 describe("buildSpawnTutorial", () => {
   it("names the cli + pid and lists the drive commands with that pid", () => {
     const out = buildSpawnTutorial("claude", 4242);

package/ts/index.ts

@@ -65,7 +65,7 @@ export type AgentCliConfig = {
   working?: RegExp[]; // regex matcher for working status
   updateAvailable?: RegExp[]; // regex matcher for update available banners
   exitCommands?: string[]; // commands to exit the cli gracefully
-  promptArg?: (string & {}) | "first-arg" | "last-arg"; // argument name to pass the prompt, e.g. --prompt, or first-arg for positional arg
+  promptArg?: (string & {}) | "first-arg" | "last-arg" | "typed"; // argument name to pass the prompt, e.g. --prompt, first-arg for positional arg, or "typed" to type it into an interactive session after ready (shells)
 
   // handle special format
   noEOL?: boolean; // if true, do not split lines by \n when handling inputs, e.g. for codex, which uses cursor-move csi code instead of \n to move lines
@@ -361,6 +361,10 @@ export default async function agentYes({
     } else if (cliConf.promptArg.startsWith("--")) {
       cliArgs = [cliConf.promptArg, prompt, ...cliArgs];
       prompt = undefined; // clear prompt to avoid sending later
+    } else if (cliConf.promptArg === "typed") {
+      // Shell mode (bash/cmd/powershell): don't pass an argv (that would
+      // run-and-exit). Leave `prompt` set so it's typed into the interactive
+      // session at onStart, keeping the shell alive afterwards.
     } else {
       logger.warn(`Unknown promptArg format: ${cliConf.promptArg}`);
     }

package/ts/serve.ts

@@ -16,6 +16,7 @@ import {
   listRecords,
   readNotes,
   readPtysize,
+  recentReadEdges,
   renderRawLog,
   resolveOne,
   snapshotStatus,
@@ -1118,6 +1119,16 @@ export async function cmdServe(rest: string[]): Promise<number> {
         const oscTitleRe = /\x1b\][02];([^\x07\x1b]*)(?:\x07|\x1b\\)/g;
         let title: string | null = null;
         for (let m; (m = oscTitleRe.exec(text)); ) if (m[1]!.trim()) title = m[1]!.trim();
+        // Defense-in-depth: this title is remote-controlled text (an agent sets its
+        // own terminal title) that the web console renders. The console escapes it,
+        // but strip C0/C1 control bytes and cap the length at the SOURCE too, so a
+        // hostile title can't smuggle control characters into any current/future
+        // sink. Quotes are left intact (legitimate titles contain them) and handled
+        // by the console's HTML escaper.
+        if (title) {
+          // eslint-disable-next-line no-control-regex
+          title = title.replace(/[\x00-\x1f\x7f-\x9f]/g, "").slice(0, 256).trim() || null;
+        }
         titleCache.set(logFile, { size, mtimeMs, title });
         return title;
       } finally {
@@ -1578,6 +1589,17 @@ export async function cmdServe(rest: string[]): Promise<number> {
       });
     }
 
+    // GET /api/edges — recent inter-agent relationship edges for the /rgui wire
+    // view. Currently the read/tail edges (agent `by` read agent `target` within
+    // the last minute, from ~/.agent-yes/reads.jsonl). Directional, ephemeral.
+    if (req.method === "GET" && p === "/api/edges") {
+      try {
+        return Response.json({ reads: await recentReadEdges() });
+      } catch (e) {
+        return new Response((e as Error).message, { status: 500 });
+      }
+    }
+
     // GET /api/whoami — this host's device label (user@host), so a remote
     // console can tag each agent with the machine it came from. Unlike codehost,
     // `ay serve --share` carries no per-agent device id; the viewer fetches this
@@ -1697,6 +1719,9 @@ export async function cmdServe(rest: string[]): Promise<number> {
           return new Response(`pid ${record.pid}: no log_file`, { status: 404 });
         const logPath = record.log_file;
 
+        // Assigned inside start(); called by BOTH the stream's cancel() and the
+        // req.signal abort listener, so client-disconnect teardown can't leak.
+        let cleanup = () => {};
         const stream = new ReadableStream({
           async start(ctrl) {
             const enc = new TextEncoder();
@@ -1769,9 +1794,21 @@ export async function cmdServe(rest: string[]): Promise<number> {
             } catch {
               /* fs.watch unsupported — the fallback poll below still works */
             }
-            const poller = setInterval(() => void flush(), 60);
-
-            req.signal.addEventListener("abort", () => {
+            // When fs.watch is live it already gives instant echo, so the poll is
+            // only a safety net → 500ms. Without a watcher it IS the primary path
+            // → keep it at 60ms for low typing-echo latency. This matters when many
+            // /api/tail streams are open at once (the /rgui viewer opens one per
+            // node): N × a 60ms poll each was needless load on the event loop.
+            const poller = setInterval(() => void flush(), watcher ? 500 : 60);
+
+            // Tear down on client disconnect via BOTH the req.signal 'abort'
+            // listener and the stream's cancel() — whichever the runtime fires
+            // (Bun uses abort here; other runtimes/paths may only cancel). `closed`
+            // makes it idempotent so it runs exactly once and never leaks the
+            // heartbeat/poller/fs-watcher/fd, however many /api/tail streams churn
+            // (the /rgui viewer opens+drops one per node while panning/zooming).
+            cleanup = () => {
+              if (closed) return;
               closed = true;
               clearInterval(heartbeat);
               clearInterval(poller);
@@ -1786,7 +1823,11 @@ export async function cmdServe(rest: string[]): Promise<number> {
               } catch {
                 /* already closed */
               }
-            });
+            };
+            req.signal.addEventListener("abort", cleanup);
+          },
+          cancel() {
+            cleanup();
           },
         });
 
@@ -2334,6 +2375,54 @@ export async function cmdServe(rest: string[]): Promise<number> {
       }
     }
 
+    // ---- Single-agent view-only shares (docs/agent-sharing.md, Option X) ------
+    // Mint / list / revoke scoped share rooms. Reachable by whoever already holds
+    // full control of this host (the local token or the master fleet room) — a
+    // scoped viewer can't reach these (its scopedFetch 403s /api/share*).
+
+    // POST /api/share  body {agent, perm?}  → mint a fresh view-only room for ONE
+    // agent and return its share link.
+    if (req.method === "POST" && p === "/api/share") {
+      let body: { agent?: string; perm?: "r" | "rw" };
+      try {
+        body = (await req.json()) as typeof body;
+      } catch {
+        return new Response("invalid JSON body", { status: 400 });
+      }
+      if (!body.agent) return new Response("agent required", { status: 400 });
+      const perm = body.perm ?? "r";
+      if (perm !== "r" && perm !== "rw")
+        return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
+      try {
+        const { createScopedShare } = await import("./agentShare.ts");
+        const share = await createScopedShare({
+          agent: body.agent,
+          perm,
+          localFetch: apiFetch,
+          apiToken: token,
+        });
+        return Response.json(share);
+      } catch (e) {
+        const msg = (e as Error).message;
+        const status = /too many active shares/.test(msg) ? 409 : /no agent matched|no stable/.test(msg) ? 404 : 500;
+        return new Response(msg, { status });
+      }
+    }
+
+    // GET /api/shares  → active scoped shares (for the manage/revoke UI).
+    if (req.method === "GET" && p === "/api/shares") {
+      const { listShares } = await import("./agentShare.ts");
+      return Response.json(listShares());
+    }
+
+    // DELETE /api/share/:shareId  → revoke (close the room).
+    const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
+    if (req.method === "DELETE" && revokeM) {
+      const { revokeShare } = await import("./agentShare.ts");
+      const ok = revokeShare(decodeURIComponent(revokeM[1]!));
+      return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
+    }
+
     return new Response("Not Found", { status: 404 });
   };
 
@@ -2342,10 +2431,31 @@ export async function cmdServe(rest: string[]): Promise<number> {
   // (the page holds no secrets); the page carries the token via the #k= link
   // and sends it on every /api call.
   const uiDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "lab", "ui");
+  // Defense-in-depth CSP for the console document served by --http (mirrors the
+  // one in lab/ui/cf/worker.ts — keep them in sync). The console renders remote
+  // host-supplied agent metadata, so we constrain where an injection could send
+  // data even though output is escaped. connect-src allows any wss: so custom
+  // signaling hosts still work; 'self' covers same-origin /api + EventSource.
+  const CONSOLE_CSP = [
+    "default-src 'self'",
+    "base-uri 'none'",
+    "object-src 'none'",
+    "frame-ancestors 'none'",
+    "form-action 'self'",
+    "img-src 'self' data:",
+    "font-src 'self' data:",
+    "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
+    "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net",
+    "connect-src 'self' https://s.agent-yes.com https://agent-yes.com wss:",
+    "worker-src 'self'",
+    "manifest-src 'self'",
+  ].join("; ");
   const serveUiFile = async (name: string, type: string): Promise<Response> => {
     try {
       const buf = await readFile(path.join(uiDir, name));
-      return new Response(buf, { headers: { "Content-Type": type } });
+      const headers: Record<string, string> = { "Content-Type": type };
+      if (type.includes("text/html")) headers["Content-Security-Policy"] = CONSOLE_CSP;
+      return new Response(buf, { headers });
     } catch {
       return new Response("UI assets not found in this install — use the /api endpoints", {
         status: 404,
@@ -2362,6 +2472,8 @@ export async function cmdServe(rest: string[]): Promise<number> {
       return serveUiFile("console-logic.js", "text/javascript; charset=utf-8");
     if (req.method === "GET" && p === "/e2e.js")
       return serveUiFile("e2e.js", "text/javascript; charset=utf-8");
+    if (req.method === "GET" && p === "/qrcode.js")
+      return serveUiFile("qrcode.js", "text/javascript; charset=utf-8");
     if (req.method === "GET" && p === "/favicon.ico") return new Response(null, { status: 204 });
     return apiFetch(req);
   };
@@ -2534,6 +2646,8 @@ export async function cmdServe(rest: string[]): Promise<number> {
   const shutdown = (resolve: () => void) => {
     if (heartbeat) clearInterval(heartbeat);
     closeShare?.();
+    // Close any scoped single-agent share rooms so viewers get an immediate drop.
+    void import("./agentShare.ts").then((m) => m.revokeAllShares()).catch(() => {});
     server?.stop();
     resolve();
   };

package/ts/share.ts

@@ -77,6 +77,13 @@ const STUN: IceServer[] = [{ urls: "stun:stun.l.google.com:19302" }];
 // TURN) to enable; without them we use STUN only, exactly as before. Cached
 // until just before expiry; STUN-only fallback on any error so sharing never
 // breaks because TURN is misconfigured or unreachable.
+//
+// Exposure note: these short-lived (1h) relay credentials are handed to every
+// browser peer that joins a room (they ride in the offer, see startPeer), so any
+// holder of a valid share link can use them to relay for the credential's
+// lifetime. That is acceptable — joining a room already requires the share
+// secret — but it means a share link also grants ~1h of Cloudflare TURN relay
+// capacity. Keep the TTL short; do not widen it.
 let iceCache: { servers: IceServer[]; exp: number } | null = null;
 async function getIceServers(): Promise<IceServer[]> {
   const keyId = process.env.CF_TURN_KEY_ID;
@@ -146,7 +153,7 @@ export async function loadOrCreateShareRoom(sighost = DEFAULT_SIGHOST): Promise<
   } catch {
     /* not yet minted */
   }
-  const room = "r" + randomBytes(3).toString("hex");
+  const room = "r" + randomBytes(6).toString("hex");
   const s = randomBytes(32).toString("hex");
   const url = `webrtc://${room}:${MARKER}${s}@${sighost}`;
   await mkdir(path.dirname(shareRoomPath()), { recursive: true });
@@ -284,7 +291,7 @@ export async function startShare(
   const initial = opts.url
     ? parseShareUrl(opts.url)
     : {
-        room: "r" + randomBytes(3).toString("hex"),
+        room: "r" + randomBytes(6).toString("hex"),
         token: `${MARKER}${randomBytes(32).toString("hex")}`,
         host: sighost,
       };
@@ -322,7 +329,7 @@ export async function startShare(
   const rotate = async (): Promise<boolean> => {
     if (!opts.onRotate || closed || rotateCount >= 5) return false;
     rotateCount++;
-    room = "r" + randomBytes(3).toString("hex");
+    room = "r" + randomBytes(6).toString("hex");
     token = `${MARKER}${randomBytes(32).toString("hex")}`;
     S = parseSecret(token).s;
     authToken = await deriveAuthToken(S, room, host);