lavish-axi 0.1.59 → 0.1.60

package/README.md

@@ -53,7 +53,7 @@ npx skills add kunchenguid/lavish-axi --skill lavish
 
 That is the entire setup - no npm install needed.
 The skill teaches your agent to run Lavish through `npx -y lavish-axi`, so the CLI comes along on demand.
-In restricted subprocess sandboxes, CI, or agent harnesses where `npx -y` exits opaquely, the skill also documents direct installed-copy fallbacks through the local or global npm install path.
+It stays a short stub and sends the agent to `npx -y lavish-axi --help`, `design`, and `playbook` for current instructions, so an installed copy cannot go stale against a newer CLI.
 Its frontmatter also includes Hermes Agent metadata, so Hermes-compatible harnesses can categorize and surface it as a first-class productivity skill.
 This installs the public `lavish` skill.
 The repository also contains an internal `lavish-design` brand skill for maintainers; default `npx skills add ... --list` and skills.sh discovery hide it unless `INSTALL_INTERNAL_SKILLS=1` is set.
@@ -184,11 +184,14 @@ pnpm link
 - **Local assets** - Copy local images, CSS, fonts, and scripts next to the HTML artifact and reference them with relative paths from that directory; root-prefixed paths such as `/assets/logo.png` will not resolve through Lavish's artifact route.
 - **Export and sharing** - `lavish-axi export` writes `<name>.export.html` by inlining local assets only, stripping the annotation SDK, and leaving remote CDN/font references as links that still need network access.
   `lavish-axi share` publishes the same local-inlined HTML to [ht-ml.app](https://ht-ml.app), a third-party hosting service not part of Lavish.
-  Publishing sends the artifact to ht-ml.app's servers, public by default, or private and password-protected with `--password`; the response includes a secret `update_key` shown once for later management.
+  Publishing sends the artifact to ht-ml.app's servers, public by default, or private and password-protected with `--private` (Lavish generates the password and returns it once, in the command output and in the browser publish dialog) or `--password <pw>` (one you supply, never echoed back). A generated password is a shared secret: give it to whoever should read the page, and expect it to appear in your agent's transcript, because the agent has to relay it. Lavish does not store it.
+  The response includes a secret `update_key` shown once. Keep it to republish the same URL later with `--site <site_id> --update-key <key>`, which replaces the HTML in place and leaves the password alone unless you pass `--private` (rotate to a new generated one) or `--password <pw>` (set one). Locking a page that was public is not instant - it can keep answering from ht-ml.app's CDN cache for minutes after the password is set - while a page that was already private has no such cached copy.
+  A page's password cannot be removed: ht-ml.app accepts a request to clear one and silently ignores it, so Lavish offers no way to make a private page public rather than telling you it did something the host did not do. Republish as a new page if you need a public URL.
+  ht-ml.app has no delete endpoint, so `--unpublish --site <site_id> --update-key <key>` replaces the page with a short placeholder and locks it behind a discarded random password rather than removing it: the URL still resolves and the host still holds what was published. The content swap is immediate, but the lock is not: a page that was public can keep serving the placeholder to uncredentialed visitors from ht-ml.app's CDN cache for minutes afterwards. The `update_key` plus `--private` republishes real content behind a new password you can share.
   Bundling never fetches remote URLs, Lavish itself does not set a CSP, local reads stay confined and size-capped, and absolute `file://` paths outside safe inlined asset references are redacted before output.
   Per-asset and per-bundle inline caps default to 10 MB and 25 MB, overridable with `LAVISH_AXI_EXPORT_MAX_ASSET_BYTES` and `LAVISH_AXI_EXPORT_MAX_BUNDLE_BYTES`.
   Unresolved local assets or export notices such as author-set CSP meta tags and redacted file URLs are surfaced in command or browser output.
-  Use `--token` or `LAVISH_AXI_HTML_APP_TOKEN` for an optional bearer token; set `LAVISH_AXI_HTML_APP_API_URL` to override the ht-ml.app API base and point `share` at a backend you control (see [Self-hosting the share backend](docs/self-hosting-share.md) for the contract it must implement).
+  Use `--token` or `LAVISH_AXI_HTML_APP_TOKEN` for an optional bearer token when publishing a new page (a republish or `--unpublish` authorizes with the `update_key` instead and rejects `--token`); set `LAVISH_AXI_HTML_APP_API_URL` to override the ht-ml.app API base and point `share` at a backend you control (see [Self-hosting the share backend](docs/self-hosting-share.md) for the contract it must implement).
 - **Live reload** - Lavish watches the HTML artifact file by default and preserves review context across reloads: the artifact iframe scroll position, an open annotation card's unsent text, and answers to `data-lavish-question` controls (application-owned form state is left alone). Unsent annotation text also survives a full reload of the review page itself. While a queued layout-issue batch is outstanding, closely spaced saves coalesce so one batch of fixes costs one refresh. To also reload on sibling asset changes, add `data-lavish-live-reload-root` to the root element or `<meta name="lavish-live-reload" content="root">`.
   If the element an unsent annotation was attached to is gone from the artifact for good, Lavish cannot reopen that card, so it writes your text into the conversation panel under **Unsent annotation** - selectable, never written over anything you have typed, and kept there across reloads; no note is ever dropped to make room for a newer one, and a note the browser refuses to store says so where it is shown.
 - **Feedback controls** - Native controls (radios, checkboxes, inputs, selects, buttons, labels, disclosure summaries, contenteditable) are interactive automatically, so they do not need `data-lavish-action`.
@@ -237,27 +240,27 @@ pnpm link
 - **Local-first state** - Session state stays under `~/.lavish-axi/` by default, or `LAVISH_AXI_STATE_DIR` when set.
 - **Diagnostic viewports** - `LAVISH_AXI_DIAGNOSTIC_VIEWPORTS` sets which viewport classes the layout-issue inbox tracks (`mobile`, `compact`, `desktop`; comma-separated, default all). Warnings whose class leaves the set are marked obsolete with an explicit reason instead of silently reading as fixed.
 - **Server port** - Set `LAVISH_AXI_PORT` to choose the server port; it defaults to `4387`.
-- **Network binding** - The server binds to loopback (`127.0.0.1`) by default. Set `LAVISH_AXI_HOST` to bind elsewhere; a wildcard (`0.0.0.0` or `::`) binds every interface. Binding beyond loopback exposes an unauthenticated server that can read and serve arbitrary local files to anything that can reach it, so only do so on a trusted network. Set `LAVISH_AXI_LINK_HOST` to control the hostname written into generated session links (defaults to the bind address, or loopback when bound to a wildcard).
-- **Allowed hosts** - To defend against DNS rebinding, the server rejects (`403`) any request whose `Host` header is missing or not one it answers to: the loopback names (`127.0.0.1`, `::1`, `localhost`) plus the configured bind and link host. If you reach the server under another name - a wildcard bind accessed by LAN IP, a reverse-proxy hostname, or an extra interface - list those names in `LAVISH_AXI_ALLOWED_HOSTS` (whitespace-separated) to allow them. Behind a reverse proxy, the forwarded `X-Forwarded-Host` is validated against the same list, so add your public hostname there and have the proxy send it together with `X-Forwarded-Proto`. Set `LAVISH_AXI_ALLOWED_HOSTS` to `*` to disable the check entirely (only when the server sits behind your own authentication or proxy). Mutating routes also reject a present foreign `Origin` or `Referer` (`403`); header-less CLI control requests remain allowed where supported.
+- **Network binding** - With Tailscale running, the review server automatically listens only on loopback (`127.0.0.1`) and this machine's Tailscale IPv4 address - never on `0.0.0.0` or every interface. The generated session link uses the machine's MagicDNS name, so it is the phone-ready URL to open from another device on the same tailnet. When Tailscale is absent or down, Lavish silently falls back to loopback-only and prints no phone URL. If Tailscale is running but MagicDNS is unavailable or its address cannot be bound after brief retries, Lavish visibly warns that phone access is unavailable and remains loopback-only. Binding beyond loopback exposes an unauthenticated server that can read and serve arbitrary local files to devices that can reach it, so the tailnet should be trusted. Any explicit `LAVISH_AXI_HOST` overrides automatic Tailscale binding; wildcard values are restricted to loopback, while a non-wildcard value selects that one concrete bind address. `LAVISH_AXI_LINK_HOST` controls the link host when automatic Tailscale binding is disabled.
+- **Allowed hosts** - To defend against DNS rebinding, the server rejects (`403`) any request whose `Host` header is missing or not one it answers to: loopback names plus the concrete Tailscale IPv4 address and MagicDNS name when the Tailscale listener is successfully bound. If you configure a reverse proxy or another intentional hostname, list it in `LAVISH_AXI_ALLOWED_HOSTS` (whitespace-separated). Behind a reverse proxy, the forwarded `X-Forwarded-Host` is validated against the same list, so add the public hostname there and have the proxy send it together with `X-Forwarded-Proto`. Set `LAVISH_AXI_ALLOWED_HOSTS` to `*` to disable the check entirely, only when the server sits behind your own authentication or proxy. Mutating routes also reject a present foreign `Origin` or `Referer` (`403`); header-less CLI control requests remain allowed where supported.
 - **Browser opening** - Set `LAVISH_AXI_NO_OPEN=1`, equivalent to `--no-open`, to create or resume a session without launching a browser window.
 
 ## CLI Reference
 
-| Command                         | Description                                                                                                                                                                                                                                                                                                                                  |
-| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `lavish-axi`                    | Show current sessions and usage guidance.                                                                                                                                                                                                                                                                                                    |
-| `lavish-axi update`             | Check for or apply the latest npm release through the AXI SDK self-updater.                                                                                                                                                                                                                                                                  |
-| `lavish-axi <html-file>`        | Open or resume a Lavish Editor session, with the open-time layout gate enabled by default. Unresolved layout issues from earlier in the session are preserved. Refuses to reopen a session the user explicitly ended from the browser unless `--reopen` is passed.                                                                           |
-| `lavish-axi poll <html-file>`   | Long-poll until the user sends feedback or ends the session; detected layout issues wait in the user's Layout issues inbox and arrive only when queued. Leave no-timeout polls running, or re-run them if interrupted. Codex guidance keeps polls attached to the active turn. On `status: ended`, stop polling and do not reopen uninvited. |
-| `lavish-axi end <html-file>`    | End a session as the agent; unlike a user-initiated end from the browser, this still allows a plain reopen later.                                                                                                                                                                                                                            |
-| `lavish-axi export <html-file>` | Write a portable copy of the artifact: one HTML file with its local assets inlined, so it opens with no server and no sibling files. Remote CDN/font references are left as links.                                                                                                                                                           |
-| `lavish-axi share <html-file>`  | Publish the artifact (local assets inlined) to [ht-ml.app](https://ht-ml.app), a third-party host not part of Lavish, and print a visitable URL plus a secret update key; shares are public by default, and `--password` makes viewers enter the password before viewing.                                                                    |
-| `lavish-axi stop`               | Shut down the background server.                                                                                                                                                                                                                                                                                                             |
-| `lavish-axi playbook [id]`      | List focused artifact guidance or show one playbook; agents must open each matching playbook before writing HTML.                                                                                                                                                                                                                            |
-| `lavish-axi design`             | Show agent-facing design guidance, including optional CDN snippets and the whiteboard (Mermaid) opt-in snippet.                                                                                                                                                                                                                              |
-| `lavish-axi setup hooks`        | Install or repair optional SessionStart hooks for Claude Code, Codex, OpenCode, and GitHub Copilot CLI; restart the agent session afterward.                                                                                                                                                                                                 |
-| `lavish-axi setup plugin`       | Register the installed package as an [Agent Plugin](https://agent-plugins.org) in VS Code, Cursor, and GitHub Copilot CLI; opt-in, idempotent, no marketplace involved. Reload each client afterward.                                                                                                                                        |
-| `lavish-axi server`             | Run the local Lavish Editor server.                                                                                                                                                                                                                                                                                                          |
+| Command                         | Description                                                                                                                                                                                                                                                                                                                                               |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `lavish-axi`                    | Show current sessions and usage guidance.                                                                                                                                                                                                                                                                                                                 |
+| `lavish-axi update`             | Check for or apply the latest npm release through the AXI SDK self-updater.                                                                                                                                                                                                                                                                               |
+| `lavish-axi <html-file>`        | Open or resume a Lavish Editor session, with the open-time layout gate enabled by default. Unresolved layout issues from earlier in the session are preserved. Refuses to reopen a session the user explicitly ended from the browser unless `--reopen` is passed.                                                                                        |
+| `lavish-axi poll <html-file>`   | Long-poll until the user sends feedback or ends the session; detected layout issues wait in the user's Layout issues inbox and arrive only when queued. Leave no-timeout polls running, or re-run them if interrupted. Codex guidance keeps polls attached to the active turn. On `status: ended`, stop polling and do not reopen uninvited.              |
+| `lavish-axi end <html-file>`    | End a session as the agent; unlike a user-initiated end from the browser, this still allows a plain reopen later.                                                                                                                                                                                                                                         |
+| `lavish-axi export <html-file>` | Write a portable copy of the artifact: one HTML file with its local assets inlined, so it opens with no server and no sibling files. Remote CDN/font references are left as links.                                                                                                                                                                        |
+| `lavish-axi share <html-file>`  | Publish the artifact (local assets inlined) to [ht-ml.app](https://ht-ml.app), a third-party host not part of Lavish, and print a visitable URL plus a secret update key; shares are public by default, `--private` locks one behind a generated password, and the same command republishes or unpublishes an existing page with `--site`/`--update-key`. |
+| `lavish-axi stop`               | Shut down the background server.                                                                                                                                                                                                                                                                                                                          |
+| `lavish-axi playbook [id]`      | List focused artifact guidance or show one playbook; agents must open each matching playbook before writing HTML.                                                                                                                                                                                                                                         |
+| `lavish-axi design`             | Show agent-facing design guidance, including optional CDN snippets and the whiteboard (Mermaid) opt-in snippet.                                                                                                                                                                                                                                           |
+| `lavish-axi setup hooks`        | Install or repair optional SessionStart hooks for Claude Code, Codex, OpenCode, and GitHub Copilot CLI; restart the agent session afterward.                                                                                                                                                                                                              |
+| `lavish-axi setup plugin`       | Register the installed package as an [Agent Plugin](https://agent-plugins.org) in VS Code, Cursor, and GitHub Copilot CLI; opt-in, idempotent, no marketplace involved. Reload each client afterward.                                                                                                                                                     |
+| `lavish-axi server`             | Run the local Lavish Editor server.                                                                                                                                                                                                                                                                                                                       |
 
 Known playbook IDs: `diagram`, `table`, `comparison`, `plan`, `code`, `input`, `slides`.
 One artifact often combines several playbooks, such as a plan that includes a comparison and a diagram, so agents must match against each `use_when` trigger and open every matching playbook before writing HTML.
@@ -272,8 +275,12 @@ For flows, architecture, state, or sequence diagrams, open the diagram playbook
 | `lavish-axi <html-file>` | `--reopen`            | Reopen a session the user explicitly ended from the browser; without it, a plain open refuses and explains why instead of reopening uninvited.                                                                                      |
 | `lavish-axi update`      | `--check`             | Report current vs latest npm version without installing an update.                                                                                                                                                                  |
 | `lavish-axi export`      | `--out <path>`        | Write the export to a specific path instead of `<name>.export.html` next to the source.                                                                                                                                             |
-| `lavish-axi share`       | `--password <pw>`     | Make the third-party ht-ml.app page private; viewers must supply the password.                                                                                                                                                      |
-| `lavish-axi share`       | `--token <t>`         | Attach an optional bearer token (`LAVISH_AXI_HTML_APP_TOKEN`); never required to publish.                                                                                                                                           |
+| `lavish-axi share`       | `--private`           | Make the page private behind a password Lavish generates and returns once; hand it to viewers as a shared secret.                                                                                                                   |
+| `lavish-axi share`       | `--password <pw>`     | Make the third-party ht-ml.app page private with a password you supply; viewers must supply the password. An empty or whitespace-only value (an unquoted `$PW` that is unset) is refused rather than publishing a public page.      |
+| `lavish-axi share`       | `--site <site_id>`    | Republish an existing page in place (with `--update-key`) instead of creating a new one; the URL does not change.                                                                                                                   |
+| `lavish-axi share`       | `--update-key <key>`  | The secret returned when the page was published; required to republish or unpublish it.                                                                                                                                             |
+| `lavish-axi share`       | `--unpublish`         | Replace a published page with a locked placeholder (ht-ml.app cannot delete); takes `--site` and `--update-key` and no file.                                                                                                        |
+| `lavish-axi share`       | `--token <t>`         | Attach an optional bearer token (`LAVISH_AXI_HTML_APP_TOKEN`) when creating a page; never required, and rejected on a republish or `--unpublish`, where the `update_key` is the credential.                                         |
 | `lavish-axi poll`        | `--agent-reply "..."` | Show the agent's reply in the existing browser chat, conclude delivered work, and return presence to waiting before polling again.                                                                                                  |
 | `lavish-axi poll`        | `--timeout-ms <ms>`   | Test/debug escape hatch only; agents should normally omit it and leave the long poll running.                                                                                                                                       |
 | `lavish-axi stop`        | `--port <port>`       | Shut down a server running on a non-default port.                                                                                                                                                                                   |

package/dist/chrome-client.js

@@ -133,8 +133,18 @@ const shareStatus = /** @type {HTMLDivElement} */ (document.getElementById("shar
 const shareResult = /** @type {HTMLDivElement} */ (document.getElementById("shareResult"));
 const shareUrlInput = /** @type {HTMLInputElement} */ (document.getElementById("shareUrl"));
 const shareUpdateKeyInput = /** @type {HTMLInputElement} */ (document.getElementById("shareUpdateKey"));
+const shareGenerateInput = /** @type {HTMLInputElement} */ (document.getElementById("shareGenerate"));
+const sharePasswordResult = /** @type {HTMLLabelElement} */ (document.getElementById("sharePasswordResult"));
+const shareUrlResult = /** @type {HTMLLabelElement} */ (document.getElementById("shareUrlResult"));
+const shareUpdateKeyResult = /** @type {HTMLLabelElement} */ (document.getElementById("shareUpdateKeyResult"));
+const shareUpdateKeyNote = /** @type {HTMLParagraphElement} */ (document.getElementById("shareUpdateKeyNote"));
+const shareSiteIdResult = /** @type {HTMLLabelElement} */ (document.getElementById("shareSiteIdResult"));
+const shareSiteIdInput = /** @type {HTMLInputElement} */ (document.getElementById("shareSiteId"));
+const sharePasswordOutput = /** @type {HTMLInputElement} */ (document.getElementById("sharePasswordOut"));
+const copySharePasswordButton = /** @type {HTMLButtonElement} */ (document.getElementById("copySharePassword"));
 const copyShareUrlButton = /** @type {HTMLButtonElement} */ (document.getElementById("copyShareUrl"));
 const copyUpdateKeyButton = /** @type {HTMLButtonElement} */ (document.getElementById("copyUpdateKey"));
+const copyShareSiteIdButton = /** @type {HTMLButtonElement} */ (document.getElementById("copyShareSiteId"));
 const endButton = /** @type {HTMLButtonElement} */ (document.getElementById("end"));
 const copyPathButton = /** @type {HTMLButtonElement} */ (document.getElementById("copyPath"));
 const copyHint = /** @type {HTMLSpanElement} */ (document.getElementById("copyHint"));
@@ -1898,16 +1908,68 @@ async function exportArtifact() {
   }
 }
 
+// ONE owner for the whole result panel. Every path that renders an outcome - dialog open, a
+// successful publish, a retry after any failure, an indeterminate report, an incomplete 200 -
+// routes through here, because a row shown or hidden by one path and reset by another is how a
+// retry after a failed publish came to display "Published" with the once-only update_key still
+// hidden. Each row is derived from the value it would show, so nothing can be half-rendered.
+function renderShareResult({ url = "", siteId = "", password = "", updateKey = "" } = {}) {
+  shareUrlInput.value = url;
+  shareUrlResult.hidden = !url;
+  // A self-hosted backend may not return one, and an empty box with a copy button is worse than
+  // no row. Never derive it from the URL: that shape belongs to the backend, not Lavish.
+  shareSiteIdInput.value = siteId;
+  shareSiteIdResult.hidden = !siteId;
+  sharePasswordOutput.value = password;
+  sharePasswordResult.hidden = !password;
+  shareUpdateKeyInput.value = updateKey;
+  shareUpdateKeyResult.hidden = !updateKey;
+  // The note's own copy tells the user to republish with `--site <site id> --update-key <key>`,
+  // so it may only appear when BOTH halves of that credential are on screen. An update key with
+  // no usable site id cannot update anything, and the status line says so instead.
+  shareUpdateKeyNote.hidden = !(updateKey && siteId);
+  shareResult.hidden = !(url || siteId || password || updateKey);
+  // Returned so every sentence in the status line is derived from what was actually rendered.
+  // Copy stamped from the request instead has promised rows the panel does not contain.
+  return { url, siteId, password, updateKey };
+}
+
+// Wording shared with the CLI's next_step for the same condition, so the two surfaces cannot
+// drift into describing the same dead end differently.
+const NO_SITE_ID_WARNING =
+  " The host did not return a site id Lavish can use, and --site is half the republish credential, so this page can NEVER be republished or unpublished even though its update key is in hand.";
+
+// What the page is gated behind, said only in terms of what the panel can show. A password the
+// user typed is never echoed by the server, so pointing at a row that was not rendered is the
+// same confidently-wrong sentence this feature exists to avoid.
+function publishedVisibilityText(isPublic, rendered, publicText) {
+  if (isPublic) return publicText;
+  return rendered.password ? "behind the password below" : "behind the password you supplied";
+}
+
 function openShareDialog() {
   closeMenus();
   shareDialog.hidden = false;
   shareStatus.textContent = "";
   shareStatus.classList.remove("error");
-  shareResult.hidden = true;
+  renderShareResult();
+  shareGenerateInput.checked = false;
   sharePasswordInput.value = "";
+  syncSharePasswordInput();
   sharePasswordInput.focus();
 }
 
+// A generated password and a typed one are the same field to the server, so the checkbox owns
+// the input rather than the two racing to decide what gets published.
+function syncSharePasswordInput() {
+  const generating = shareGenerateInput.checked;
+  sharePasswordInput.disabled = generating;
+  sharePasswordInput.placeholder = generating
+    ? "Lavish will generate one when you publish"
+    : "Leave blank for a public page";
+  if (generating) sharePasswordInput.value = "";
+}
+
 function closeShareDialog() {
   shareDialog.hidden = true;
 }
@@ -1920,24 +1982,83 @@ async function copyToButton(value, button, label) {
   }, 1200);
 }
 
+function reportIndeterminatePublish(data) {
+  const rendered = renderShareResult({ password: data.password || "" });
+  shareStatus.classList.add("error");
+  const reason = data.error ? data.error + " " : "";
+  const visibility = publishedVisibilityText(data.public, rendered, "PUBLIC - anyone with the link could read it");
+  shareStatus.textContent =
+    reason +
+    "ht-ml.app may or may not have published this page, so treat the outcome as unknown. If it did publish, the page is live " +
+    visibility +
+    ", and its URL and update key were lost with the failed response, so it can never be republished or unpublished. Publishing again creates a SECOND page rather than replacing it." +
+    (rendered.password ? " Copy the password now - it is shown once here and Lavish does not store it." : "");
+}
+
+// An incomplete 200 is NOT an unknown outcome: the host answered, so the page landed. Whatever
+// fields did arrive are rendered, because a url with no update_key names a live, public-by-default
+// page whose only write credential is gone - and saying "may or may not" there would throw away
+// the address Lavish is holding.
+function reportIncompletePublish(data) {
+  const rendered = renderShareResult({
+    url: data.url || "",
+    siteId: data.site_id || "",
+    password: data.password || "",
+    updateKey: data.update_key || "",
+  });
+  shareStatus.classList.add("error");
+  const visibility = publishedVisibilityText(data.public, rendered, "PUBLIC - anyone with the link can read it");
+  const updateKeyNote = !rendered.updateKey
+    ? "No update key came back, and ht-ml.app issues one only once and has no delete, so this page can never be republished or unpublished. "
+    : rendered.siteId
+      ? "Copy the update key below - it is issued once. "
+      : "Copy the update key below - it is issued once, though" + NO_SITE_ID_WARNING.slice(1) + " ";
+  shareStatus.textContent =
+    "ht-ml.app accepted this publish, so the page IS live and " +
+    visibility +
+    ", but its response was malformed and Lavish could not read the whole result back. " +
+    (rendered.url ? "Its address is below. " : "The response carried no URL, so Lavish cannot show the address. ") +
+    updateKeyNote +
+    "Publishing again creates a SECOND page rather than replacing it." +
+    (rendered.password ? " Copy the password now - it is shown once here and Lavish does not store it." : "");
+}
+
 async function publishShare(event) {
   event.preventDefault();
   sharePublishButton.disabled = true;
   shareStatus.classList.remove("error");
   shareStatus.textContent = "Publishing to ht-ml.app...";
-  shareResult.hidden = true;
-  const password = sharePasswordInput.value.trim();
-  const passwordProtected = Boolean(password);
+  renderShareResult();
+  const generating = shareGenerateInput.checked;
+  const password = generating ? "" : sharePasswordInput.value.trim();
+  const passwordProtected = generating || Boolean(password);
   try {
     const response = await fetch("/api/" + key + "/share", {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify(password ? { password } : {}),
+      body: JSON.stringify(generating ? { generate_password: true } : password ? { password } : {}),
     });
     const data = await response.json();
-    if (!response.ok) throw new Error(data.error || "publish failed");
-    shareUrlInput.value = data.url || "";
-    shareUpdateKeyInput.value = data.update_key || "";
+    if (!response.ok) {
+      // Only a host rejection proves nothing was published. On anything else the page may already
+      // be live, and a password minted for this request is the one thing that could still open it,
+      // so it is shown here rather than dying with the failed response.
+      if (data.outcome === "published-incomplete") {
+        reportIncompletePublish(data);
+        return;
+      }
+      if (data.outcome === "indeterminate") {
+        reportIndeterminatePublish(data);
+        return;
+      }
+      throw new Error(data.error || "publish failed");
+    }
+    const rendered = renderShareResult({
+      url: data.url || "",
+      siteId: data.site_id || "",
+      password: data.password || "",
+      updateKey: data.update_key || "",
+    });
     const unresolvedAssets = Array.isArray(data.unresolved_local_assets) ? data.unresolved_local_assets : [];
     const notices = Array.isArray(data.notices) ? data.notices : [];
     const warningCount = unresolvedAssets.length;
@@ -1951,10 +2072,16 @@ async function publishShare(event) {
           : passwordProtected
             ? "Published. This page is PASSWORD-PROTECTED; viewers also need the password."
             : "Published. Anyone with the link can view this page.";
-    shareResult.hidden = false;
+    if (rendered.updateKey && !rendered.siteId) shareStatus.textContent += NO_SITE_ID_WARNING;
+    if (rendered.password) {
+      shareStatus.textContent += " Copy the password now - it is shown once here and Lavish does not store it.";
+    }
     shareUrlInput.focus();
     shareUrlInput.select();
   } catch (error) {
+    // Deliberately does NOT clear the panel. It is already cleared before the fetch, so the only
+    // thing this could reach is a result the success path already rendered - and wiping that
+    // destroys the once-issued update_key of a page that definitely published.
     shareStatus.classList.add("error");
     shareStatus.textContent = error instanceof Error ? error.message : String(error);
   } finally {
@@ -3087,6 +3214,10 @@ shareDialog.addEventListener("click", (event) => {
 });
 copyShareUrlButton.onclick = () => copyToButton(shareUrlInput.value, copyShareUrlButton, "Copy URL");
 copyUpdateKeyButton.onclick = () => copyToButton(shareUpdateKeyInput.value, copyUpdateKeyButton, "Copy key");
+copySharePasswordButton.onclick = () =>
+  copyToButton(sharePasswordOutput.value, copySharePasswordButton, "Copy password");
+copyShareSiteIdButton.onclick = () => copyToButton(shareSiteIdInput.value, copyShareSiteIdButton, "Copy site ID");
+shareGenerateInput.onchange = syncSharePasswordInput;
 endButton.onclick = () => {
   closeMenus();
   endSession();

package/dist/chrome.css

@@ -803,6 +803,23 @@ body.lavish {
 .share-grid input::placeholder {
   color: var(--fg-label);
 }
+.share-grid .share-check {
+  grid-template-columns: auto 1fr;
+  grid-auto-flow: column;
+  align-items: center;
+  gap: var(--space-6);
+  color: var(--fg-muted);
+  font-size: var(--text-sm);
+  font-weight: var(--w-regular);
+  letter-spacing: 0;
+  text-transform: none;
+  cursor: pointer;
+}
+.share-grid .share-check input {
+  width: auto;
+  padding: 0;
+  accent-color: var(--accent);
+}
 .share-status {
   min-height: 20px;
   margin-top: var(--space-8);
@@ -824,6 +841,9 @@ body.lavish {
 .share-result[hidden] {
   display: none;
 }
+.share-result label[hidden] {
+  display: none;
+}
 .share-copy-row {
   display: flex;
   gap: var(--space-6);