dsh-claude-whiteboard 2.14.0 → 2.14.1

package/lib/index.js

@@ -1,4 +1,4 @@
-// dsh-claude-whiteboard 2.14.0: built from baoyu-design.
+// dsh-claude-whiteboard 2.14.1: built from baoyu-design.
 var define_PLUGIN_default = { name: "claude-whiteboard", provider: "dsh-claude-whiteboard", skills: [{ name: "claude-whiteboard", description: "Use this for a local Whiteboard: a shared space for laying out thinking in whatever form it needs (a diagram, a flow, a map of ideas, a plan, a comparison, a drawn explanation, a small working embed) that opens in the bundled board editor, where people move, draw, comment and send comments to the agent. Its content lives in the board's own store, written with this skill's script, never in files you edit by hand. Read it before you create a board or change one. Not for a slide deck, a document, a film or a static HTML page.", scriptAlias: "A", comments: true }] };
 
 import { readFile } from "node:fs/promises";
@@ -110,13 +110,14 @@ function runtimeSection(skill, skillDir, node, platform = process.platform, watc
       skill.commentsBy === "mention" ? "(read the block, change the doc with `update`, then `comment-reply`)." : "(change the files, then `comment-reply`).",
       "So do not start `comments --wait` yourself, where Comments says to: run `open` in the foreground (not",
       "`run_in_background`), and the wait starts with it. It stops when the editor stops; after `stop`, the next `open`",
-      "starts it again.",
+      "starts it again. Harness starts the next wait when your turn ends, which is where this skill says to wait again:",
+      "finish what a message asks for in the turn that takes it.",
       ...skill.commentsBy === "mention" ? ["", "When you first give the link, tell the user that a comment with `@agent` in it reaches you (type `@` and pick agent)."] : [],
       ...skill.requests ? [
         "",
         "The page's buttons reach you the same way: a request one of them sends arrives as such a message, under",
-        "`requests` (its words in `text`, the button in `label`). Those are the user's words, as if typed here: handle",
-        "them as this skill says for those words."
+        "`requests` (the button in `label`, what it asks in `text`), as `comments <root> --wait` printed it for that",
+        "page. It is a request from the page wherever this skill speaks of one: handle it as this skill says for those."
       ] : []
     );
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-claude-whiteboard",
-  "version": "2.14.0",
+  "version": "2.14.1",
   "description": "DeepSeek Harness plugin: the claude-whiteboard skill from baoyu-design. The agent lays out diagrams, flows, maps of ideas and plans on a whiteboard and opens it in a local board editor where you move, draw and comment.",
   "keywords": [
     "dsh",
@@ -24,6 +24,12 @@
   "icon": "./icon.svg",
   "baoyuDesign": {
     "releaseNotes": [
+      {
+        "version": "2.14.1",
+        "date": "2026-11-11",
+        "en": "### Features\n- **DeepSeek Harness: open your work from another device.** When Harness runs on one computer and you use it from another (`dsh web` on a server, opened in a browser on your laptop or phone over the same network or a tailnet), opening an item from **Artifacts**, or **View thread** on a comment card, gave a `http://127.0.0.1:…` link that only that computer can open. The plugin now gives the device you are on a link of its own, at the address your browser reaches Harness by, and opens it in a new tab. Through it you are the editor's owner, as on that computer: you edit, and **Send to Agent** is there. Behind a proxy or a domain of your own, set `BAOYU_DESIGN_REMOTE_HOST` to the address other devices reach that computer at; `off` turns this off. Every editor's `open` takes `--remote[=<host>]` to print that owner's link (`--remote=off` closes it), and `share <folder> --reset owner` replaces its key. See [Use it from another device](https://github.com/JimLiu/baoyu-design/blob/main/dsh-plugins/README.md#use-it-from-another-device) (requested by @akaDeyve, [#40](https://github.com/JimLiu/baoyu-design/issues/40)).\n- **DeepSeek Harness: `dsh-claude-dashboard` updates to `dsh-claude-data`.** The Artifacts page names the type **Data**, and offers an installed `dsh-claude-dashboard` as an update, `claude-dashboard → claude-data`: **Update** installs `dsh-claude-data`, switched on or off as the old one was, then uninstalls `dsh-claude-dashboard`. A preset that names `dsh-claude-dashboard` keeps it, and the page says what to change. 2.14.0 said `dsh-claude-dashboard` would get no more updates; instead it keeps getting releases with no skill in them. An Artifacts page from 2.13.0 or earlier offers that release as an update, and it brings the page that offers the move, so click **Update** once more when the move shows.\n\n### Fixes\n- `claude-design-system`: a guest on a **Share** link could not add an asset or a font. The page stayed at **Adding …**, because a page served over plain http on the network lacks the browser's hashing that the upload used. It now hashes the file itself.\n- DeepSeek Harness: uninstalling the plugin that was running the Artifacts page left the page at a 404 until the app restarted. Another installed plugin now takes it over at once.",
+        "zh": "### 新功能\n- **DeepSeek Harness：在另一台设备上打开你的作品。** Harness 跑在一台电脑上、你在另一台设备上用时（比如服务器上跑 `dsh web`，在笔记本或手机的浏览器里通过同一个局域网或 tailnet 打开），从 **Artifacts**（「作品」）打开，或者点评论卡片上的 **View thread**，拿到的是 `http://127.0.0.1:…`，只有那台电脑打得开。现在插件会给你手上这台设备一个它自己的链接，地址就是浏览器访问 Harness 用的那个，在新标签页里打开。通过它打开，你就是编辑器的主人，和在那台电脑上一样：能编辑，也有 **Send to Agent**。经过代理或用自己的域名访问时，把 `BAOYU_DESIGN_REMOTE_HOST` 设成其他设备访问那台电脑用的地址；设成 `off` 就关掉这个功能。每个编辑器的 `open` 都可以加 `--remote[=<host>]`，打出这个主人链接（`--remote=off` 关掉），`share <文件夹> --reset owner` 换一把钥匙。见[在另一台设备上用](https://github.com/JimLiu/baoyu-design/blob/main/dsh-plugins/README.zh-CN.md#在另一台设备上用)（@akaDeyve 提出，[#40](https://github.com/JimLiu/baoyu-design/issues/40)）。\n- **DeepSeek Harness：`dsh-claude-dashboard` 可以更新成 `dsh-claude-data`。** 「作品」页上这个类型叫 **数据**（Data），装着 `dsh-claude-dashboard` 的，会把换到新插件当作一项更新来提示，写作 `claude-dashboard → claude-data`：点 **Update**（更新）会先装上 `dsh-claude-data`（开关和旧插件一样），再卸载 `dsh-claude-dashboard`。预设里写了 `dsh-claude-dashboard` 的，旧插件会留着，页面上会说要改哪里。2.14.0 说 `dsh-claude-dashboard` 不再更新；现在改成它继续发不带技能的版本。2.13.0 或更早的「作品」页会把这个版本当作更新来提示，装上它就有了会提示换插件的新「作品」页，提示出来后再点一次 **Update**。\n\n### 修复\n- `claude-design-system`：通过 **Share**（分享）链接进来的访客加不了资源和字体，页面一直停在 **Adding …**。局域网上用明文 http 打开的页面没有浏览器自带的哈希功能，上传要用它。现在由页面自己算。\n- DeepSeek Harness：卸载正在提供「作品」页的那个插件后，这个页面一直是 404，要重启应用才好。现在另一个装着的插件会马上接手。"
+      },
       {
         "version": "2.14.0",
         "date": "2026-11-11",
@@ -65,12 +71,6 @@
         "date": "2026-11-05",
         "en": "### Features\n- **DeepSeek Harness: the Artifacts page offers the plugins you haven't installed.** Beside the tiles for the skills you have, each other baoyu-design plugin gets a dimmed tile marked **Not installed**. Click it to see what the plugin makes and install it from there, at the same version as the ones you have, usually without a restart. Once it's in, **Start** opens a session with the skill. In an app that can't install from the page, the tile points you to the Plugins page. A plugin you installed and switched off still gets no tile.\n\n### Fixes\n- With `--agent-hook`, a comment could reach the agent twice: a second send could start the hook again after the first run had finished but before the comment was marked sent.",
         "zh": "### 新功能\n- **DeepSeek Harness：「作品」页会列出你还没装的插件。** 已装技能的入口旁边，其他 baoyu-design 插件也各有一个入口，颜色淡一些，标着 **未安装**。点开会说明这个插件做什么，可以直接在这里安装，版本和你已装的一致，多数情况不用重启。装好后点 **新建** 就用这个技能开一个会话。应用不支持在页面里安装时，会引导你去插件页。装了但被你关掉的插件，仍然没有入口。\n\n### 修复\n- 用 `--agent-hook` 时，一条评论可能发给 agent 两次：第一次运行已经结束、评论还没标成已发送时，第二次发送会再启动一次 hook。"
-      },
-      {
-        "version": "2.11.0",
-        "date": "2026-11-05",
-        "en": "### Features\n- **DeepSeek Harness: a new version no longer pops up over the app.** The **Artifacts** row in the left sidebar gets an **Update** label instead (a dot on the icon, where a collapsed sidebar keeps its icons), and a panel at the top of the Artifacts page shows the versions, each plugin and what the release changes. **Update all** updates them together; **Update** on a plugin's line takes just that one. **Later** folds the panel to one line and removes the label until the next version.\n- While an update runs you can leave the Artifacts page: the label says **Updating**, **Failed** or **Restart**. **Try again** picks up where it stopped: the rest after **Update all**, that plugin after its own **Update**.\n- The **Update** button on a plugin's page now updates only that plugin, and a page that was open when its plugin was replaced comes back by itself.",
-        "zh": "### 新功能\n- **DeepSeek Harness：新版本不再弹出来打断你。** 左侧栏的 **Artifacts**（「作品」）这一行会多一个 **更新** 标签（侧栏收起后还留着图标的话，是图标上的小圆点），「作品」页顶部的面板写着版本、每个插件和这次改了什么。**全部更新** 一起更新；每个插件那一行的 **更新** 只更新它自己。**稍后** 把面板收成一行，标签也消失，等下一个版本再提示。\n- 更新时可以离开「作品」页：标签会显示 **更新中**、**更新失败** 或 **待重启**。**重试** 从停下的地方接着来：**全部更新** 失败就接着更新剩下的，单独更新失败就再试这一个。\n- 插件详情页的 **更新** 按钮现在只更新这一个插件；更新时开着的页面被替换后，会自己回来。"
       }
     ]
   },
@@ -96,7 +96,7 @@
     "dsh": ">=0.2.0-0"
   },
   "dependencies": {
-    "dsh-claude-artifacts": "^2.14.0"
+    "dsh-claude-artifacts": "^2.14.1"
   },
   "dsh": {
     "bundle": {

package/skills/claude-whiteboard/scripts/artifact.mjs

@@ -242,6 +242,7 @@ function sendFile(request, response, file, headers) {
 var errorText = (error) => error instanceof Error ? error.message : String(error);
 
 import { spawn } from "node:child_process";
+import dns from "node:dns/promises";
 import { EventEmitter } from "node:events";
 import fs3 from "node:fs";
 import http from "node:http";
@@ -297,6 +298,7 @@ var Sharing = class _Sharing {
         if (isRecord(link) && typeof link.token === "string" && link.token.length >= 16) state.links[role] = { token: link.token, on: link.on !== false };
       }
     }
+    if (isRecord(raw.owner) && typeof raw.owner.token === "string" && raw.owner.token.length >= 32) state.owner = { token: raw.owner.token };
     if (Array.isArray(raw.guests)) {
       for (const g of raw.guests) {
         if (!isRecord(g) || typeof g.id !== "string" || typeof g.secret !== "string" || !isGuestRole(g.role) || typeof g.link !== "string") continue;
@@ -327,6 +329,27 @@ var Sharing = class _Sharing {
     }
     return null;
   }
+  /** The owner's link token (`state.owner`), made and saved the first time it is asked for. */
+  ownerToken() {
+    if (!this.state.owner) {
+      this.state.owner = { token: token(32) };
+      this.save();
+    }
+    return this.state.owner.token;
+  }
+  /** Whether `given` is the owner's link token (a cookie or a link's). */
+  isOwnerToken(given) {
+    const own = this.state.owner?.token;
+    if (!given || !own) return false;
+    const a = Buffer.from(given);
+    const b = Buffer.from(own);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+  }
+  /** A new owner's link: the old one, and every browser that came in through it, stop working. */
+  resetOwner() {
+    this.state.owner = { token: token(32) };
+    this.save();
+  }
   /** The guest a cookie names, if they still have access (their link on and not reset). */
   guest(secret) {
     if (!secret) return null;
@@ -588,6 +611,8 @@ var Hub = class {
   hosts = /* @__PURE__ */ new Set();
   /** One listener per LAN address while any site is open to the network. */
   lanServers = /* @__PURE__ */ new Map();
+  /** Names that resolve to an address listened on, asked for by `allowName` (lower case, no port). */
+  lanNames = /* @__PURE__ */ new Set();
   network;
   constructor(options) {
     this.echo = options.echo;
@@ -603,7 +628,8 @@ var Hub = class {
       },
       addresses: () => [...this.lanServers.keys()],
       open: () => this.openLan(),
-      release: () => this.releaseLan()
+      release: () => this.releaseLan(),
+      allowName: (name) => this.allowName(name)
     };
   }
   createServer() {
@@ -722,9 +748,9 @@ var Hub = class {
     }
     return [...this.lanServers.keys()];
   }
-  /** A site stopped sharing: the listeners stay while another is shared. */
+  /** A site stopped sharing: the listeners stay while another is shared, or open to its owner on another device. */
   releaseLan() {
-    if (![...this.sites.values()].some((site) => site.share.shared)) this.closeLan();
+    if (![...this.sites.values()].some((site) => site.share.listening)) this.closeLan();
   }
   closeLan() {
     for (const server of this.lanServers.values()) {
@@ -732,8 +758,30 @@ var Hub = class {
       server.closeAllConnections?.();
     }
     this.lanServers.clear();
+    this.lanNames.clear();
+  }
+  /** The machine's own names, as hostAllowed takes them. */
+  isMachineName(name) {
+    const machine = os2.hostname().toLowerCase();
+    return name === machine || name === `${machine.replace(/\.local$/, "")}.local`;
   }
-  /** A Host header this hub answers: its own names, and while something is shared, its LAN addresses and machine name. */
+  /**
+   * Answer at `name` too while listening: an address listened on, the machine's name, or a name that resolves to an
+   * address listened on (looked up once, now: Tailscale's MagicDNS name, a hosts entry).
+   */
+  async allowName(name) {
+    const lower = name.toLowerCase();
+    if (!lower || !this.lanServers.size) return false;
+    if (this.lanServers.has(lower) || this.isMachineName(lower) || this.lanNames.has(lower)) return true;
+    const found = await dns.lookup(lower, { all: true, family: 4 }).catch(() => []);
+    if (!found.some((entry) => this.lanServers.has(entry.address))) return false;
+    this.lanNames.add(lower);
+    return true;
+  }
+  /**
+   * A Host header this hub answers: its own names, and while something is shared (or open to its owner on another
+   * device), its LAN addresses, its machine name and the names allowName took.
+   */
   hostAllowed(request) {
     const host = request.headers.host ?? "";
     if (this.hosts.has(host)) return true;
@@ -741,8 +789,7 @@ var Hub = class {
     const suffix = `:${this.port}`;
     if (!host.endsWith(suffix)) return false;
     const name = host.slice(0, -suffix.length).toLowerCase();
-    const machine = os2.hostname().toLowerCase();
-    return this.lanServers.has(name) || name === machine || name === `${machine.replace(/\.local$/, "")}.local`;
+    return this.lanServers.has(name) || this.isMachineName(name) || this.lanNames.has(name);
   }
   // ---- requests --------------------------------------------------------------------------------------------------
   /** The site whose address `pathname` is under, with the path below it. */
@@ -1330,6 +1377,12 @@ function commentsViewer(viewer) {
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var esc = (text) => text.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 var script = (value) => JSON.stringify(value).replace(/</g, "\\u003c");
+function hostName(host) {
+  const value = host.trim().toLowerCase();
+  if (value.startsWith("[")) return value.slice(1, value.indexOf("]") > 0 ? value.indexOf("]") : void 0);
+  const colons = value.split(":").length - 1;
+  return colons === 1 ? value.slice(0, value.indexOf(":")) : value;
+}
 function localOwner() {
   let name = "You";
   try {
@@ -1351,6 +1404,8 @@ var ShareHost = class {
   page;
   /** Open to the local network now (the hub's listeners are up, for this artifact too). */
   on = false;
+  /** Open to its owner on another device (`open --remote`): the listeners are up, guests stay out unless `on`. */
+  remote = false;
   live = /* @__PURE__ */ new Set();
   constructor(options) {
     this.options = options;
@@ -1376,6 +1431,10 @@ var ShareHost = class {
   get shared() {
     return this.on;
   }
+  /** Someone may reach it over the network now (guests, or its owner on another device): the hub keeps listening. */
+  get listening() {
+    return this.on || this.remote;
+  }
   /** The artifact's name, for the join page and the list of what is open at the server's root. */
   title() {
     return this.options.title();
@@ -1398,30 +1457,61 @@ var ShareHost = class {
     this.options.log(`shared on the local network: ${addresses.map((a) => `http://${a}:${this.port}${this.page}`).join(", ") || "(no LAN address)"}`);
     return addresses;
   }
+  /**
+   * Opens the artifact to its owner on another device, or closes that, and returns the owner's link, at `host` when
+   * that is this computer's (the address the owner's browser already reaches it by), else at its first network address.
+   * Guests are not let in by it: that is `setLan`.
+   */
+  async setRemote(on, host) {
+    if (!on) {
+      this.remote = false;
+      for (const live of [...this.live]) if (live.viewer.remote) live.close("unshared");
+      this.network.release();
+      return null;
+    }
+    const addresses = await this.network.open();
+    if (!addresses.length) {
+      this.network.release();
+      throw new ShareError("This computer has no network address to open it at.");
+    }
+    this.remote = true;
+    const name = hostName(host ?? "");
+    const sorted = [...addresses].sort((a, b) => Number(isTailnet(a)) - Number(isTailnet(b)));
+    const address = name && (addresses.includes(name) || await this.network.allowName?.(name)) ? name : sorted[0];
+    const url = `http://${address.includes(":") ? `[${address}]` : address}:${this.port}${this.page}o/${this.sharing.ownerToken()}`;
+    this.options.log(`open to its owner on another device at http://${address}:${this.port}${this.page}`);
+    return { url, address };
+  }
   /** The artifact left the hub: it stays shared in .sharing.json, for the next time it opens. */
   close() {
     this.on = false;
+    this.remote = false;
     this.network.release();
   }
   // ---- who is asking ---------------------------------------------------------------------------------------------
-  cookie(request) {
+  cookie(request, name = this.options.cookieName) {
     for (const part of (request.headers.cookie ?? "").split(";")) {
       const eq = part.indexOf("=");
-      if (eq > 0 && part.slice(0, eq).trim() === this.options.cookieName) return part.slice(eq + 1).trim();
+      if (eq > 0 && part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
     }
     return void 0;
   }
+  /** The cookie the owner's link leaves in a browser on another device. */
+  get ownerCookie() {
+    return `${this.options.cookieName}_owner`;
+  }
   /**
-   * Who a request is: the owner over loopback, a guest by their cookie (while their link is on and the artifact is
-   * shared), else nobody. Loopback is always the owner, so trying a link on this computer can't lock the owner out of
-   * their own artifact; a guest comes over a LAN address (this computer's own included: that is how the owner sees
-   * what a role sees).
+   * Who a request is: the owner over loopback, or by the owner's link's cookie while the artifact is open to them on
+   * another device; a guest by their cookie (while their link is on and the artifact is shared), else nobody. Loopback
+   * is always the owner, so trying a link on this computer can't lock the owner out of their own artifact; a guest
+   * comes over a LAN address (this computer's own included: that is how the owner sees what a role sees).
    */
   isLocal(request) {
     return this.options.local ? this.options.local(request) : isLoopback(request.socket.remoteAddress);
   }
   viewerOf(request) {
     if (this.isLocal(request)) return { role: "owner", user: this.options.owner };
+    if (this.remote && this.sharing.isOwnerToken(this.cookie(request, this.ownerCookie))) return { role: "owner", user: this.options.owner, remote: true };
     const guest = this.on ? this.sharing.guest(this.cookie(request)) : null;
     if (!guest) return null;
     this.sharing.seen(guest);
@@ -1455,7 +1545,8 @@ var ShareHost = class {
     const p = new URL(request.url ?? "/", "http://local").pathname;
     const method = request.method ?? "GET";
     const link = /^\/s\/([A-Za-z0-9_-]{16,64})$/.exec(p);
-    const ours = link || p === "/__share" || p.startsWith("/__share/");
+    const ownerLink = /^\/o\/([A-Za-z0-9_-]{16,64})$/.exec(p);
+    const ours = link || ownerLink || p === "/__share" || p.startsWith("/__share/");
     if (!ours) return false;
     if (method === "POST" && !sameOrigin(request)) {
       request.resume();
@@ -1467,6 +1558,12 @@ var ShareHost = class {
       else response.writeHead(405, { Allow: "GET, POST" }).end();
       return true;
     }
+    if (ownerLink) {
+      request.resume();
+      if (method === "GET" || method === "HEAD") this.ownerIn(request, response, ownerLink[1]);
+      else response.writeHead(405, { Allow: "GET" }).end();
+      return true;
+    }
     const viewer = this.viewerOf(request);
     if (!viewer) {
       this.denied(request, response);
@@ -1550,6 +1647,24 @@ var ShareHost = class {
     const url = `http://127.0.0.1:${this.port}${this.page}`;
     return `<p class="note">${esc(t.ownerHere)} <a href="${esc(url)}">${esc(url)}</a></p>`;
   }
+  /**
+   * GET /o/<token>: the owner's link. On another device it leaves the owner's cookie (while the artifact is open to them
+   * there) and goes on to the page, its query kept (`?comment=` opens a thread); over loopback it is the page anyway.
+   */
+  ownerIn(request, response, token2) {
+    const local = this.isLocal(request);
+    if (!this.sharing.isOwnerToken(token2) || !local && !this.remote) {
+      const t = this.words(request);
+      return this.sendPage(response, 404, t.linkGoneTitle, `<h1>${esc(t.linkGoneTitle)}</h1><p>${esc(t.linkGone)}</p>`);
+    }
+    const search = new URL(request.url ?? "/", "http://local").search;
+    const headers = { Location: `${this.page}${search}`, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" };
+    if (!local) {
+      headers["Set-Cookie"] = `${this.ownerCookie}=${token2}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000`;
+      this.options.log(`share: the owner came in from another device (${request.socket.remoteAddress})`);
+    }
+    response.writeHead(303, headers).end();
+  }
   /** GET /s/<token>: the name form (or straight in, for a guest already in through this link); POST: join. */
   async join(request, response, method, token2) {
     const t = this.words(request);
@@ -1607,6 +1722,7 @@ var ShareHost = class {
     return {
       title: this.options.title(),
       lan: this.on,
+      remote: this.remote,
       port: this.port,
       page: this.page,
       addresses,
@@ -1618,11 +1734,13 @@ var ShareHost = class {
   }
   /**
    * The owner's sharing calls: `lan` {on}, `link` {role, on}, `reset` {role} (a new link: the old one and the guests
-   * who came through it stop working), `role` {guest, role} (a guest's role, while that role's link is on), `remove`
-   * {guest}. Answers the view after.
+   * who came through it stop working; role `owner` the owner's own link), `role` {guest, role} (a guest's role, while
+   * that role's link is on), `remove` {guest}, `remote` {on, host?} (open to the owner on another device: the answer
+   * then has `remoteLink` {url, address}, the owner's link). Answers the view after.
    */
   async share(action) {
     const role = action.role;
+    let remote = null;
     switch (action.action) {
       case "lan": {
         const addresses = await this.setLan(action.on === true);
@@ -1634,9 +1752,17 @@ var ShareHost = class {
         this.sharing.setLink(role, action.on === true);
         break;
       case "reset":
-        if (!isGuestRole(role)) throw new ShareError("role: editor, commenter or viewer");
+        if (role === "owner") {
+          this.sharing.resetOwner();
+          for (const live of [...this.live]) if (live.viewer.remote) live.close("revoked");
+          break;
+        }
+        if (!isGuestRole(role)) throw new ShareError("role: owner, editor, commenter or viewer");
         this.sharing.resetLink(role);
         break;
+      case "remote":
+        remote = await this.setRemote(action.on === true, typeof action.host === "string" ? action.host : void 0);
+        break;
       case "role": {
         if (!isGuestRole(role)) throw new ShareError("role: editor, commenter or viewer");
         if (typeof action.guest !== "string" || !this.sharing.state.guests.some((g) => g.id === action.guest)) throw new ShareError("no such guest");
@@ -1648,11 +1774,11 @@ var ShareHost = class {
         if (typeof action.guest !== "string" || !this.sharing.removeGuest(action.guest)) throw new ShareError("no such guest");
         break;
       default:
-        throw new ShareError("action: lan, link, reset, role or remove");
+        throw new ShareError("action: lan, link, reset, role, remove or remote");
     }
     this.options.log(`share: ${JSON.stringify(action)}`);
     this.dropRevoked();
-    return this.shareView();
+    return { ...this.shareView(), ...remote ? { remoteLink: remote } : {} };
   }
   async shareApi(request, response, method) {
     if (method === "GET") return sendJson(response, 200, this.shareView());
@@ -2906,11 +3032,11 @@ async function shareCall(url, action, fail2) {
   if (!response.ok) fail2("SHARE_REFUSED", String(body.message ?? `the server answered ${response.status}`));
   return body;
 }
-function rolesOf(flags, key, fail2) {
+function rolesOf(flags, key, fail2, owner = false) {
   const given = flags.get(key);
   if (given === void 0) return [];
   const roles = given === "all" || given === "true" ? [...GUEST_ROLES] : given.split(",").map((r) => r.trim());
-  for (const role of roles) if (!isGuestRole(role)) fail2("INVALID_ROLE", `--${key}: editor, commenter, viewer or all (got ${role}).`);
+  for (const role of roles) if (!isGuestRole(role) && !(owner && role === "owner")) fail2("INVALID_ROLE", `--${key}: ${owner ? "owner, " : ""}editor, commenter, viewer or all (got ${role}).`);
   return roles;
 }
 function guestRoles(flags, fail2) {
@@ -2925,7 +3051,7 @@ function guestRoles(flags, fail2) {
 async function shareCommand(o) {
   const off = o.flags.has("off");
   const changes = [
-    ...rolesOf(o.flags, "reset", o.fail).map((role) => ({ action: "reset", role })),
+    ...rolesOf(o.flags, "reset", o.fail, true).map((role) => ({ action: "reset", role })),
     ...rolesOf(o.flags, "enable", o.fail).map((role) => ({ action: "link", role, on: true })),
     ...rolesOf(o.flags, "disable", o.fail).map((role) => ({ action: "link", role, on: false })),
     ...guestRoles(o.flags, o.fail)
@@ -2935,7 +3061,8 @@ async function shareCommand(o) {
   if (!server) {
     const sharing = new Sharing(o.root);
     for (const change of changes) {
-      if (change.action === "reset") sharing.resetLink(change.role);
+      if (change.action === "reset" && change.role === "owner") sharing.resetOwner();
+      else if (change.action === "reset") sharing.resetLink(change.role);
       else if (change.action === "role") {
         if (!sharing.setRole(String(change.guest), change.role)) o.fail("SHARE_REFUSED", `No guest ${String(change.guest)}, or the ${String(change.role)} link is off.`);
       } else sharing.setLink(change.role, change.on === true);
@@ -2981,6 +3108,30 @@ async function shareCommand(o) {
 }
 var NOT_SHARED_HINT = "share <root> with no options shares it.";
 var lanUrls = (view) => (Array.isArray(view.addresses) ? view.addresses : []).map((a) => `http://${String(a)}:${String(view.port)}${String(view.page ?? "/")}`);
+async function remoteOn(url, flags, fail2, stopCommand) {
+  const given = flags.get("remote");
+  if (given === void 0) return {};
+  const call = async (action) => {
+    const response = await fetch(new URL("__share", url), { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(action) });
+    const body = await response.json().catch(() => ({}));
+    if (response.ok) return body;
+    if (response.status === 400 && /^action: /.test(String(body.message ?? ""))) {
+      fail2("REMOTE_UNSUPPORTED", `The editor server running for this folder is of an earlier release and cannot open it to another device. Run ${stopCommand}, then open again.`);
+    }
+    return fail2("SHARE_REFUSED", String(body.message ?? `the server answered ${response.status}`));
+  };
+  if (given === "off") {
+    await call({ action: "remote", on: false });
+    return { remote: false };
+  }
+  const view = await call({ action: "remote", on: true, ...given && given !== "true" ? { host: given } : {} });
+  const link = view.remoteLink;
+  if (typeof link?.url !== "string") return fail2("SHARE_REFUSED", "The server did not give the owner's link.");
+  return {
+    remoteUrl: link.url,
+    remoteNote: `remoteUrl opens the editor as its owner from another device that reaches this computer at ${String(link.address)} (an app reached remotely, a phone, a laptop on the same network or tailnet). It is the owner's own key, over plain http: open it only on your own devices and give it to nobody (to let others in, \`share\`). \`--remote=off\` closes it; \`share <root> --reset owner\` replaces it.`
+  };
+}
 async function lanOn(url, flags, fail2) {
   if (!flags.has("lan")) return {};
   return { lan: lanUrls(await shareCall(url, { action: "lan", on: true }, fail2)) };
@@ -3902,7 +4053,7 @@ function print(value, compact = false) {
   process.stdout.write(`${compact ? JSON.stringify(value) : JSON.stringify(value, null, 2)}
 `);
 }
-var BARE_FLAGS = ["text", "json", "wait", "all", "resolve", "reopen", "lan", "off", "force"];
+var BARE_FLAGS = ["text", "json", "wait", "all", "resolve", "reopen", "lan", "remote", "off", "force"];
 function parseArgs(argv) {
   const positional = [];
   const flags = /* @__PURE__ */ new Map();
@@ -4822,12 +4973,12 @@ var lanOn2 = (url, flags) => lanOn(url, flags, fail);
 async function open(root, flags) {
   const existing = await runningServer2(root);
   if (existing) {
-    print({ url: existing.url, root, pid: existing.pid, reused: true, ...await lanOn2(existing.url, flags), log: path9.join(root, LOG_FILE), stop: cmd("stop", root) }, true);
+    print({ url: existing.url, root, pid: existing.pid, reused: true, ...await lanOn2(existing.url, flags), ...await remoteOn(existing.url, flags, fail, cmd("stop", root)), log: path9.join(root, LOG_FILE), stop: cmd("stop", root) }, true);
     return;
   }
   const state = await startBackground(root, flags);
   const empty = !fs10.existsSync(docFile(root, ["board", "meta"]));
-  print({ url: state.url, root, pid: state.pid, ...state.lan?.length ? { lan: state.lan } : {}, log: path9.join(root, LOG_FILE), stop: cmd("stop", root), ...empty ? { note: "board/meta is not written yet: the page shows an empty board until it is." } : {} }, true);
+  print({ url: state.url, root, pid: state.pid, ...state.lan?.length ? { lan: state.lan } : {}, ...await remoteOn(state.url, flags, fail, cmd("stop", root)), log: path9.join(root, LOG_FILE), stop: cmd("stop", root), ...empty ? { note: "board/meta is not written yet: the page shows an empty board until it is." } : {} }, true);
 }
 async function startBackground(root, flags) {
   const port = flags.has("port") ? Number(flags.get("port")) : DEFAULT_PORT;
@@ -5022,6 +5173,8 @@ Usage:
   node scripts/artifact.mjs serve    <root> [--port n] [--lan]   the same server, in the foreground
                                      [--agent-hook "<command>"]  open/serve: run this for each comment sent to the agent
                                                                   (the comment as JSON on stdin); --lan: shared too
+                                     [--remote[=<host>]]         open: also open it to you on another device (<host>: how
+                                                                  that device reaches this computer); prints remoteUrl
   node scripts/artifact.mjs stop     <root>                      stop the background board server
   node scripts/artifact.mjs share    <root>                      share on the local network; prints a link per role
                                      [--off] [--reset R] [--enable R] [--disable R]