shraga 0.1.115 → 0.1.117

package/dist/client/index.html

@@ -13,7 +13,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-CeGkHIed.js"></script>
+    <script type="module" crossorigin src="/assets/index-Bke9ulHK.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CFxKc8dH.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.115",
+  "version": "0.1.117",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/client/App.tsx

@@ -31,7 +31,11 @@ import {
   BookOpen,
   Blocks,
   SquarePen,
+  ShieldCheck,
 } from 'lucide-react';
+import { useOwner } from '@/hooks/useOwner';
+import { api } from '@/lib/api';
+import { OwnerConsole } from '@/components/owner/OwnerConsole';
 import { useDarkMode } from '@/hooks/useDarkMode';
 import { useUnread } from '@/hooks/useUnread';
 import { ToastStack } from '@/components/Toast';
@@ -68,6 +72,7 @@ function AppInner() {
   const slots = useSlots();
   const { dark, toggle: toggleDark } = useDarkMode();
   const { user, token, getToken, loading, mode, needsSetup, loginLocal, registerLocal, logout } = useAuth();
+  const { isOwner, call: ownerCall } = useOwner(getToken);
   const [sidebarOpen, _setSidebarOpen] = useState(() => localStorage.getItem('shraga:sidebarOpen') !== 'false');
   const setSidebarOpen = useCallback((v: boolean | ((prev: boolean) => boolean)) => {
     _setSidebarOpen((prev) => {
@@ -229,6 +234,12 @@ function AppInner() {
   const { socket, connectionStatus, authError } = useAgentSocket(token, getToken, handleGlobalEvent);
 
   const { unreads, toasts, markRead, dismissToast, addToast, handleUnreadEvent } = useUnread(socket, activeSessionId);
+  // Owner Console → open any user's session: the meta fetch confirms access (owner view-only bypass) before selecting.
+  const openOwnerSession = useCallback(async (id: string) => {
+    await api(`/api/sessions/${encodeURIComponent(id)}/meta`, getToken);
+    openSession(id);
+    markRead(id);
+  }, [getToken, openSession, markRead]);
   unreadEventRef.current = handleUnreadEvent;
   markReadRef.current = markRead;
 
@@ -425,6 +436,17 @@ function AppInner() {
                 {dark ? <Sun className="w-4 h-4" /> : <Moon className="w-4 h-4" />}
               </Button>
               {slots.headerActions?.()}
+              {isOwner && (
+                <OwnerConsole
+                  call={ownerCall}
+                  onOpenSession={openOwnerSession}
+                  trigger={
+                    <Button variant="ghost" size="icon" className="h-8 w-8" title="Owner Console">
+                      <ShieldCheck className="w-4 h-4" />
+                    </Button>
+                  }
+                />
+              )}
               <McpManager getToken={getToken} />
               <SkillsManager getToken={getToken} onSkillsChange={setSkills} />
               <ModulesManager getToken={getToken} />
@@ -454,6 +476,17 @@ function AppInner() {
                     style={{ top: mobileMenuPos.top, right: mobileMenuPos.right }}
                   >
                     {slots.headerActions?.()}
+                    {isOwner && (
+                      <OwnerConsole
+                        call={ownerCall}
+                        onOpenSession={openOwnerSession}
+                        trigger={
+                          <button className="flex w-full items-center gap-2.5 rounded-md px-3 py-2.5 text-sm hover:bg-accent">
+                            <ShieldCheck className="w-3.5 h-3.5" /> Owner Console
+                          </button>
+                        }
+                      />
+                    )}
                     <McpManager
                       getToken={getToken}
                       trigger={

package/src/client/components/Sidebar.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useRef, useState } from 'react';
-import { Plus, MessageSquare, Hash, AtSign, MessageCircle, ShieldCheck } from 'lucide-react';
+import { Plus, MessageSquare, Hash, AtSign, MessageCircle } from 'lucide-react';
 import { Button } from './ui/button';
 import { ScrollArea } from './ui/scroll-area';
 import { cn } from '@/lib/utils';
@@ -10,9 +10,6 @@ import type { UnreadSession } from '@/hooks/useUnread';
 import type { AgentSocket } from '@/lib/ws';
 import { useSessionList, type SessionRow as Session, type ChatsFilter } from '@/hooks/useSessionList';
 import { CLIENT_BUILD_VERSION } from '@/lib/build-version';
-import { useOwner } from '@/hooks/useOwner';
-import { api } from '@/lib/api';
-import { OwnerConsole } from './owner/OwnerConsole';
 
 interface Props {
   getToken: () => Promise<string | null>;
@@ -78,7 +75,6 @@ export function Sidebar({ getToken, activeSessionId, onSelect, onNew, refreshKey
   const [filter, setFilter] = useState<ChatsFilter>(() => (localStorage.getItem(FILTER_KEY) as ChatsFilter) || 'mine');
   const [unreadOnly, setUnreadOnly] = useState(() => localStorage.getItem(UNREAD_FILTER_KEY) === 'true');
   const [version, setVersion] = useState<string>('');
-  const { isOwner, call: ownerCall } = useOwner(getToken);
   const activeRef = useRef<HTMLButtonElement | null>(null);
 
   function changeFilter(f: ChatsFilter) {
@@ -246,17 +242,6 @@ export function Sidebar({ getToken, activeSessionId, onSelect, onNew, refreshKey
       </ScrollArea>
 
       <div className="px-4 py-2 flex flex-col items-center gap-1">
-        {isOwner && (
-          <OwnerConsole
-            call={ownerCall}
-            onOpenSession={async (id) => { await api(`/api/sessions/${encodeURIComponent(id)}/meta`, getToken); onSelect(id); }}
-            trigger={
-              <button className="flex items-center gap-1.5 text-[11px] text-muted-foreground hover:text-foreground transition-colors" title="Roles, bindings, keys, blocklist, audit">
-                <ShieldCheck className="w-3.5 h-3.5" /> Owner Console
-              </button>
-            }
-          />
-        )}
         <MachineStats socket={socket ?? null} getToken={getToken} />
         {slots.sidebarExtras?.()}
         {version && (

package/src/server/auth.ts

@@ -31,7 +31,7 @@ import { dataPath } from './paths.ts';
 import { apiKeyPrincipal, validateApiKey } from './api-keys.ts';
 import { isOwnerEmail } from './owners.ts';
 import { fromAuthUser, fromInternal, type Principal } from './security/principal.ts';
-import { security } from './security/runtime.ts';
+import { loginAllowed, security } from './security/runtime.ts';
 import { firebaseIssuedAt, tokenRevoked } from './security/revocation.ts';
 
 // Issued-at (`iat`) + revocation: every token format below carries `iat` for NEW tokens, in a shape the pre-iat
@@ -154,17 +154,6 @@ export function verifyMcpToken(token: string): { uid: string; email: string; kin
   return { kind, uid, email };
 }
 
-const WHITELIST_PATH = dataPath('whitelist.json');
-
-function loadWhitelist(): string[] {
-  if (!existsSync(WHITELIST_PATH)) return [];
-  try {
-    return JSON.parse(readFileSync(WHITELIST_PATH, 'utf-8'));
-  } catch {
-    return [];
-  }
-}
-
 export interface AuthUser {
   uid: string;
   email: string;
@@ -195,12 +184,11 @@ export async function verifyToken(token: string): Promise<AuthUser> {
     if (msg.includes('aud')) throw new Error(`Token audience mismatch (expected ${projectId}). Please sign out and sign in again.`);
     throw new Error(msg);
   }
-  const whitelist = loadWhitelist();
-  if (whitelist.length > 0 && !whitelist.includes(payload.email)) {
-    throw new Error('User not in whitelist');
-  }
   const uid = payload.user_id || payload.sub;
   const principal = fromAuthUser({ uid, email: payload.email });
+  // Login gate = policy bindings (member rank+) or OWNERS; fails closed. The message keeps the word 'whitelist':
+  // the client (App.tsx, useAgentSocket, lib/ws) keys its permanent "not allowed" handling on it.
+  if (!loginAllowed(principal)) throw new Error('User not in whitelist — ask an owner to add a binding (Owner Console → Bindings)');
   // auth_time = sign-in time; the hourly-refreshed iat would outlive a revocation.
   if (tokenRevoked(principal.id, firebaseIssuedAt(payload))) throw new Error('Token revoked — sign in again');
   return authUser(uid, payload.email, principal);

package/src/server/boot.ts

@@ -72,6 +72,7 @@ import { claudeAccountDir } from './claude-account.ts';
 import { ClaudeLogin, ClaudeLoginError } from './claude-login.ts';
 import { getAll as getAllContacts } from './contacts.ts';
 import { artifactsRouter } from './artifacts/artifacts.routes.ts';
+import { setSharedFileHeaders } from './share-file.ts';
 import { ownerRouter } from './security/owner-routes.ts';
 import { handleArtifactToolUse } from './artifacts/artifacts.handler.ts';
 import { registerEngine } from './engine/index.ts';
@@ -853,7 +854,7 @@ app.get('/api/workspace/raw', requireAuth, (req, res) => {
   res.sendFile(resolved);
 });
 
-app.use('/uploads/shared', express.static(dataPath('uploads/shared'), { dotfiles: 'deny', index: false }));
+app.use('/uploads/shared', express.static(dataPath('uploads/shared'), { dotfiles: 'deny', index: false, setHeaders: setSharedFileHeaders }));
 app.use('/uploads', requireAuth, express.static(dataPath('uploads'), { dotfiles: 'deny', index: false }));
 
 app.post('/api/upload', requireAuth, express.raw({ type: '*/*', limit: '50mb' }), (req, res) => {

package/src/server/engine/claude-code.ts

@@ -23,8 +23,9 @@ import { APP_ROOT } from '../paths.ts';
 import { writeMcpConfigFile } from './mcp-config-file.ts';
 import { claudeUsageFor } from '../claude-usage.ts';
 import { claudeAccountDir, applyClaudeAccount, claudeAccountRef, type ClaudeAccountRef } from '../claude-account.ts';
-import { buildAgentEnv, builtinTools, filterMcpServers, allowsEscalate, allowsInternalToken, SENSITIVE_PATH_PATTERNS } from '../security/enforce.ts';
+import { buildAgentEnv, builtinTools, filterMcpServers, allowsEscalate, allowsInternalToken, allowsShare, SHARE_TOOL_ID, SENSITIVE_PATH_PATTERNS } from '../security/enforce.ts';
 import { escalateMcpServer } from '../security/escalate.ts';
+import { shareMcpServer } from '../share-file.ts';
 const IMMUTABLE_SYSTEM_PROMPT = readFileSync(path.resolve(import.meta.dirname, '../../../defaults/system-prompt.md'), 'utf-8');
 const DEFAULT_USER_PROMPT = `You are a helpful assistant with access to MCP tools.`;
 const DEFAULT_ALLOWED_TOOLS = ['Read', 'Edit', 'Bash', 'WebSearch', 'Glob', 'LS', 'ToolSearch'];
@@ -517,6 +518,12 @@ export class ClaudeCodeEngine implements AgentEngine {
       });
       options['mcpServers'] = { [server.name]: server };
     }
+    // `share_file` (in-process, like escalate): full-access turns only — flag OFF every turn is full.
+    if (!eff || allowsShare(eff.profile)) {
+      const server = shareMcpServer();
+      options['mcpServers'] = { ...(options['mcpServers'] as object | undefined), [server.name]: server };
+      options['allowedTools'] = [...allowedTools, SHARE_TOOL_ID];
+    }
 
     const mcpNames = mcpServers ? Object.keys(mcpServers) : [];
     const activeModel = (options['model'] as string) || 'default';

package/src/server/mcp-oauth.ts

@@ -14,9 +14,9 @@
 import type { Express, Request, Response, NextFunction } from 'express';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { randomBytes, createHash } from 'node:crypto';
-import { MCP_TOKEN_TTL, requireAuth, signMcpToken, verifyMcpToken, type AuthUser } from './auth.ts';
+import { AUTH_PROVIDER, MCP_TOKEN_TTL, requireAuth, signMcpToken, verifyMcpToken, type AuthUser } from './auth.ts';
 import { dataPath } from './paths.ts';
-import { security } from './security/runtime.ts';
+import { loginAllowed, security } from './security/runtime.ts';
 import { fromAuthUser } from './security/principal.ts';
 import { tokenRevoked } from './security/revocation.ts';
 
@@ -201,6 +201,11 @@ export function registerMcpOAuthRoutes(app: Express) {
     if (grant === 'refresh_token') {
       const id = b.refresh_token ? verifyMcpToken(b.refresh_token) : null;
       if (!id || id.kind !== 'refresh') return void res.status(400).json({ error: 'invalid_grant', error_description: 'invalid refresh_token' });
+      // Re-apply the Firebase login gate: a 30d refresh must not outlive the user's removal from the policy bindings.
+      if (AUTH_PROVIDER === 'firebase' && !loginAllowed(fromAuthUser(id))) {
+        security()?.authDeny('mcp:oauth-refresh', 'not-whitelisted', req.ip);
+        return void res.status(400).json({ error: 'invalid_grant', error_description: 'User not in whitelist — sign in again' });
+      }
       return void res.json({
         access_token: signMcpToken(id.uid, id.email, 'access', ACCESS_TTL),
         token_type: 'Bearer',

package/src/server/security/enforce.ts

@@ -36,6 +36,13 @@ export const ESCALATE_SERVER = 'security';
 export const ESCALATE_TOOL = 'escalate';
 export const ESCALATE_TOOL_ID = `mcp__${ESCALATE_SERVER}__${ESCALATE_TOOL}`;
 
+/** In-process MCP server carrying `share_file` (share-file.ts): publishes a file under a public link. Full (`*` tools)
+ *  profiles only — a restricted principal must not be able to publish arbitrary files to the internet. */
+export const SHARE_SERVER = 'shraga-share';
+export const SHARE_TOOL = 'share_file';
+export const SHARE_TOOL_ID = `mcp__${SHARE_SERVER}__${SHARE_TOOL}`;
+export const allowsShare = (p: Pick<Profile, 'tools'>) => p.tools.includes('*');
+
 /** `escalate` is opt-in by name (reply-only). `*` profiles don't get it: they can act, not just ask. */
 export const allowsEscalate = (p: Pick<Profile, 'tools'>) => p.tools.includes(ESCALATE_TOOL);
 export const allowsMcpServer = (p: Pick<Profile, 'mcps'>, server: string) => p.mcps.includes('*') || p.mcps.includes(server);
@@ -58,6 +65,7 @@ export function profileAllowsTool(p: Pick<Profile, 'tools' | 'mcps'>, tool: stri
   if (tool.startsWith('mcp__')) {
     const server = tool.slice(5).split('__')[0];
     if (server === ESCALATE_SERVER) return allowsEscalate(p);
+    if (server === SHARE_SERVER) return allowsShare(p);
     return allowsMcpServer(p, server) || p.tools.includes(tool);
   }
   const b = builtinTools(p);

package/src/server/security/runtime.ts

@@ -9,6 +9,7 @@
 // deduped per key per window, so a busy client isn't one line per request.
 import { MEMBER_ROLE, OWNER_ROLE, Policy, type PolicyOptions, type Resolved, type TamperReason } from './policy.ts';
 import { getAgentConfig } from '../agent-config.ts';
+import { isOwnerEmail } from '../owners.ts';
 import { Audit, type AuditEvent, type AuditOptions } from './audit.ts';
 import { Guard, type GuardOptions, type TurnAdmission } from './guard.ts';
 import { fromAuthUser, type Principal } from './principal.ts';
@@ -166,6 +167,31 @@ export function admitTurn(principal: Principal, ctx?: { ip?: string; channel?: s
   catch (e: any) { console.error(`[security] admitTurn threw — admitting: ${e?.message ?? e}`); return { ok: true, release: () => {} }; }
 }
 
+/** `member` rank of a VALID policy, else undefined. A fail-closed policy keeps only owner+anonymous, and resolving an
+ *  unknown role falls back to the DEFAULT role — whose rank would wrongly admit a guest. So require a real `member` role. */
+function memberRankOf(rt: SecurityRuntime | undefined): number | undefined {
+  if (!rt || !rt.policy.valid) return undefined;
+  const member = rt.policy.effective(Infinity, MEMBER_ROLE);
+  return member.role === MEMBER_ROLE ? member.rank : undefined;
+}
+
+/**
+ * May this interactive login (a verified `user` principal) use the app? The Firebase login gate — it replaced
+ * `whitelist.json`. Allowed iff an OWNER (OWNERS env), or the policy resolves it at/above `member` rank.
+ * FAILS CLOSED for everyone else: no runtime yet (before boot's initSecurity), an invalid/fail-closed policy, or a throw
+ * ⇒ `false`. Owners are checked first and without the policy, so a broken policy can never lock them out.
+ */
+export function loginAllowed(principal: Principal): boolean {
+  if (principal.kind === 'user' && principal.verified && principal.email && isOwnerEmail(principal.email)) return true;
+  try {
+    const memberRank = memberRankOf(current);
+    return memberRank !== undefined && resolvePrincipal(current!.policy, principal).rank >= memberRank;
+  } catch (e: any) {
+    console.error(`[security] loginAllowed threw — denying: ${e?.message ?? e}`);
+    return false;
+  }
+}
+
 /**
  * May the agent send an AUTOMATIC outbound reply to this inbound principal? For channels and add-ons
  * (mail, chat) to call before handing the model's text back to the sender.
@@ -198,17 +224,14 @@ export function mayReplyTo(principal: Principal, ctx: { sessionId?: string; turn
   try {
     if (getAgentConfig().allowUntrustedReplies === true) return true;
     const rt = current;
-    if (!rt || !rt.policy.valid) return false;
-    // A fail-closed policy keeps only owner+anonymous, and resolving an unknown role falls back to the
-    // DEFAULT role — whose rank would wrongly admit a guest. So require a real `member` role.
-    const member = rt.policy.effective(Infinity, MEMBER_ROLE);
-    if (member.role !== MEMBER_ROLE) return false;
+    const memberRank = memberRankOf(rt);
+    if (!rt || memberRank === undefined) return false;
     const r = resolvePrincipal(rt.policy, principal);
-    if (principal.verified && r.rank >= member.rank) return true;
+    if (principal.verified && r.rank >= memberRank) return true;
     rt.record({
       type: 'guard.limit', principal: principal.id, role: r.role, sessionId: ctx.sessionId,
       target: ctx.channel ?? 'reply', reason: 'untrusted-reply',
-      meta: { kind: principal.kind, verified: principal.verified, rank: r.rank, memberRank: member.rank },
+      meta: { kind: principal.kind, verified: principal.verified, rank: r.rank, memberRank },
     }, `reply.suppressed|${ctx.turnId ?? ctx.sessionId ?? principal.id}`);
     return false;
   } catch (e: any) {

package/src/server/share-file.ts

@@ -0,0 +1,119 @@
+// `share_file` — the ONLY way the agent hands a user a link to a file. It copies the file into the public
+// `uploads/shared` dir (boot.ts serves it unauthenticated) under an unguessable name and returns the absolute URL.
+// Before this the agent built share URLs by hand and invented routes that fell through to the SPA shell.
+import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk';
+import { mkdirSync, realpathSync, statSync } from 'node:fs';
+import { copyFile, stat, unlink } from 'node:fs/promises';
+import type { ServerResponse } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import path from 'node:path';
+import { z } from 'zod/v4';
+import { DATA_DIR } from './paths.ts';
+import { getPublicOrigin } from './shraga-config.ts';
+import { WORKSPACE_DIR } from './workspace.ts';
+import { SHARE_SERVER, SHARE_TOOL, touchesSecretPath } from './security/enforce.ts';
+
+/** URL path boot.ts serves publicly from `<data>/uploads/shared`. */
+export const SHARE_ROUTE = '/uploads/shared';
+
+export class FileSharerOptions {
+  dataDir: string = DATA_DIR;
+  /** ALLOWLIST of dirs agents write deliverables to (resolved by realpath). Never the whole data dir: it holds tokens,
+   *  config and other sessions' auth-protected uploads. */
+  roots: () => string[] = () => [WORKSPACE_DIR]; // not tmp: other processes' task outputs/credentials live there
+  /** Largest file that may be published. */
+  maxBytes: number = MAX_SHARE_BYTES;
+  origin: () => string = getPublicOrigin;
+}
+
+export const MAX_SHARE_BYTES = 500 * 1024 * 1024;
+
+/** Key/token files with no telltale extension (the secret path patterns cover .env, .pem, .key, service accounts). */
+const KEY_NAME_RE = /^(?:id_(?:rsa|dsa|ecdsa|ed25519)(?:_sk)?|credentials?(?:[._-].*)?|tokens?(?:[._-].*)?|.*[._-]tokens?\.json)$/i;
+
+export type ShareResult = { ok: true; url: string; path: string; bytes: number } | { ok: false; error: string };
+
+const real = (p: string) => { try { return realpathSync(p); } catch { return undefined; } };
+const within = (root: string, p: string) => { const r = path.relative(root, p); return !!r && !r.startsWith('..') && !path.isAbsolute(r); };
+
+export class FileSharer {
+  public constructor(public options?: Partial<FileSharerOptions>) {
+    this.options = { ...new FileSharerOptions(), ...options };
+  }
+
+  private get o() { return this.options as FileSharerOptions; }
+
+  /** Why this path may not be published, or the single realpath to copy from (no re-resolve between check and copy). */
+  public check(filePath: string): { src: string; bytes: number } | { error: string } {
+    if (!path.isAbsolute(filePath)) return { error: 'file_path must be absolute.' };
+    const src = real(filePath);
+    if (!src) return { error: `No such file: ${filePath}` };
+    const st = statSync(src);
+    if (!st.isFile()) return { error: `Not a regular file: ${filePath}` };
+    if (touchesSecretPath('Read', { file_path: filePath }) || touchesSecretPath('Read', { file_path: src }) || KEY_NAME_RE.test(path.basename(src))) return { error: 'Refusing to publish a secret/credential file.' };
+    // A hardlink shares its inode with a file elsewhere (e.g. the Claude CLI login) — realpath can't see that.
+    if (st.nlink > 1) return { error: 'Refusing to publish a hard-linked file; copy it first.' };
+    const roots = [...new Set(this.o.roots().map(real).filter((r): r is string => !!r))];
+    const root = roots.filter(r => within(r, src)).sort((a, b) => b.length - a.length)[0];
+    if (!root) return { error: `Only files under ${this.o.roots().join(', ')} can be shared.` };
+    // Hidden segments (.claude, .git, .ssh, …) hold config and credentials, never deliverables.
+    if (path.relative(root, src).split(path.sep).some(s => s.startsWith('.'))) return { error: 'Refusing to publish a file inside a hidden directory or a dotfile.' };
+    if (st.size > this.o.maxBytes) return { error: `File is ${st.size} bytes; the share limit is ${this.o.maxBytes}. Compress it or send it another way.` };
+    return { src, bytes: st.size };
+  }
+
+  public async share(filePath: string, name?: string): Promise<ShareResult> {
+    const origin = this.o.origin();
+    if (!origin) return { ok: false, error: 'This deployment has no public origin, so no share link can be made. Send the file as an attachment instead (e.g. Slack file upload).' };
+    const c = this.check(filePath);
+    if ('error' in c) return { ok: false, error: c.error };
+    const { src, bytes } = c;
+    const safe = (name || path.basename(src)).normalize('NFKD').replace(/[^\w.-]+/g, '-').replace(/^[.-]+/, '').slice(-100) || 'file';
+    const fileName = `${randomBytes(16).toString('hex')}-${safe}`;
+    const dir = path.join(this.o.dataDir, 'uploads', 'shared');
+    mkdirSync(dir, { recursive: true });
+    const dest = path.join(dir, fileName);
+    await copyFile(src, dest);
+    if ((await stat(dest)).size !== bytes) {
+      await unlink(dest).catch(e => console.warn(`[share] cleanup of ${dest} failed: ${e}`));
+      return { ok: false, error: `Copy to ${dest} is incomplete; do not send a link.` };
+    }
+    return { ok: true, url: `${origin}${SHARE_ROUTE}/${encodeURIComponent(fileName)}`, path: dest, bytes };
+  }
+}
+
+/** Extensions a browser may render inline from our origin without running script. Everything else downloads. */
+const INLINE_SAFE_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif', '.mp4', '.webm', '.mov', '.m4v', '.mp3', '.m4a', '.wav', '.ogg', '.pdf', '.txt']);
+
+/** express.static `setHeaders` for SHARE_ROUTE (agent shares AND session-less user uploads). The auth token lives in
+ *  same-origin localStorage, so a published .html/.svg must never execute here. */
+export function setSharedFileHeaders(res: ServerResponse, filePath: string) {
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('Content-Security-Policy', 'sandbox');
+  if (!INLINE_SAFE_EXT.has(path.extname(filePath).toLowerCase())) res.setHeader('Content-Disposition', 'attachment');
+}
+
+/** In-process MCP server exposing `share_file` (full-access turns only; see engine/claude-code.ts). */
+export function shareMcpServer(sharer = new FileSharer()) {
+  return createSdkMcpServer({
+    name: SHARE_SERVER,
+    version: '1.0.0',
+    tools: [tool(
+      SHARE_TOOL,
+      'Publish a local file (video, image, PDF, …) and get a public link to send the user. The ONLY valid way to make a file link — never construct share URLs by hand. Anyone with the link can open it (no login).',
+      {
+        file_path: z.string().min(1).describe('Absolute path of the file (must be under the workspace; move deliverables there first).'),
+        name: z.string().max(200).optional().describe('Download name, e.g. "ad-v2.mp4". Defaults to the file name.'),
+      },
+      async ({ file_path, name }) => {
+        let r: ShareResult;
+        try { r = await sharer.share(file_path, name); } catch (e) { r = { ok: false, error: `Share failed: ${(e as Error).message}` }; }
+        if (!r.ok) console.warn(`[share] refused ${file_path}: ${r.error}`);
+        else console.log(`[share] ${file_path} -> ${r.path} (${r.bytes} bytes)`);
+        return r.ok
+          ? { content: [{ type: 'text' as const, text: `Public link (send exactly this): ${r.url}` }] }
+          : { content: [{ type: 'text' as const, text: r.error }], isError: true };
+      },
+    )],
+  });
+}

package/src/server/workspace.ts

@@ -4,6 +4,7 @@ import { dataPath } from './paths.ts';
 import { dataSync } from './data-sync.ts';
 import { injectFile } from './file-inject.ts';
 import { getPublicOrigin } from './shraga-config.ts';
+import { SHARE_TOOL } from './security/enforce.ts';
 
 export const WORKSPACE_DIR = process.env.WORKSPACE_DIR || dataPath('workspace');
 
@@ -166,9 +167,8 @@ export function readWorkspaceFile(relPath: string): { content: string; binary: b
 
 /** How to hand a user a link to a file (video, image, PDF). Without it the agent invents share routes that don't exist. */
 function shareFilesGuide(): string {
-  const origin = getPublicOrigin();
-  if (!origin) return 'SHARING FILES: this deployment has no public origin — send files as attachments (e.g. Slack file upload), never a made-up URL.';
-  return `SHARING FILES: to give a link to a file, copy it to ${dataPath('uploads/shared')}/<random-hex>-<name> and link ${origin}/uploads/shared/<random-hex>-<name> (public, no login). Before sending, verify the link with \`curl -sI\` returns 200 and the right content-type. Never invent other share routes.`;
+  if (!getPublicOrigin()) return 'SHARING FILES: this deployment has no public origin — send files as attachments (e.g. Slack file upload), never a made-up URL.';
+  return `SHARING FILES: to give a user a link to a file, call the \`${SHARE_TOOL}\` tool if you have it and send the URL it returns; without that tool, send the file as an attachment. Never construct share URLs by hand.`;
 }
 
 export function buildWorkspaceContextBlock(): string {