shraga 0.1.116 → 0.1.118

package/dist/client/index.html

@@ -13,7 +13,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-Dtb440uD.js"></script>
+    <script type="module" crossorigin src="/assets/index-Cy5kfZ66.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CFxKc8dH.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.116",
+  "version": "0.1.118",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/client/App.tsx

@@ -72,7 +72,7 @@ function AppInner() {
   const slots = useSlots();
   const { dark, toggle: toggleDark } = useDarkMode();
   const { user, token, getToken, loading, mode, needsSetup, loginLocal, registerLocal, logout } = useAuth();
-  const { isOwner, call: ownerCall } = useOwner(getToken);
+  const { isOwner, call: ownerCall } = useOwner(getToken, !!user); // re-checks once signed in — App mounts before the token exists
   const [sidebarOpen, _setSidebarOpen] = useState(() => localStorage.getItem('shraga:sidebarOpen') !== 'false');
   const setSidebarOpen = useCallback((v: boolean | ((prev: boolean) => boolean)) => {
     _setSidebarOpen((prev) => {

package/src/client/hooks/useIsOwner.ts

@@ -8,7 +8,7 @@ export function useIsOwner(getToken: () => Promise<string | null>, enabled = tru
   const [isOwner, setIsOwner] = useState<boolean>();
 
   useEffect(() => {
-    if (!enabled) return;
+    if (!enabled) { setIsOwner(undefined); return; }
     let alive = true;
     getToken().then((token) => {
       if (!token || !alive) return;

package/src/client/hooks/useOwner.ts

@@ -6,8 +6,8 @@ import { useIsOwner } from './useIsOwner';
 export type OwnerCall = <T = any>(path: string, method?: string, body?: unknown) => Promise<T>;
 
 /** Owner Console access: `isOwner` (UI hint — the server enforces) + an authenticated caller for `/api/owner/*`. */
-export function useOwner(getToken: () => Promise<string | null>) {
-  const isOwner = useIsOwner(getToken);
+export function useOwner(getToken: () => Promise<string | null>, enabled = true) {
+  const isOwner = useIsOwner(getToken, enabled);
   const call = useCallback<OwnerCall>(async (path, method = 'GET', body) => {
     try {
       return await api(`/api/owner${path}`, getToken, { method, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });

package/src/server/share-file.ts

@@ -6,7 +6,6 @@ import { mkdirSync, realpathSync, statSync } from 'node:fs';
 import { copyFile, stat, unlink } from 'node:fs/promises';
 import type { ServerResponse } from 'node:http';
 import { randomBytes } from 'node:crypto';
-import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { z } from 'zod/v4';
 import { DATA_DIR } from './paths.ts';
@@ -21,7 +20,7 @@ export class FileSharerOptions {
   dataDir: string = DATA_DIR;
   /** ALLOWLIST of dirs agents write deliverables to (resolved by realpath). Never the whole data dir: it holds tokens,
    *  config and other sessions' auth-protected uploads. */
-  roots: () => string[] = () => [WORKSPACE_DIR, tmpdir(), '/tmp'];
+  roots: () => string[] = () => [WORKSPACE_DIR]; // not tmp: other processes' task outputs/credentials live there
   /** Largest file that may be published. */
   maxBytes: number = MAX_SHARE_BYTES;
   origin: () => string = getPublicOrigin;
@@ -103,7 +102,7 @@ export function shareMcpServer(sharer = new FileSharer()) {
       SHARE_TOOL,
       'Publish a local file (video, image, PDF, …) and get a public link to send the user. The ONLY valid way to make a file link — never construct share URLs by hand. Anyone with the link can open it (no login).',
       {
-        file_path: z.string().min(1).describe('Absolute path of the file (under the workspace or tmp).'),
+        file_path: z.string().min(1).describe('Absolute path of the file (must be under the workspace; move deliverables there first).'),
         name: z.string().max(200).optional().describe('Download name, e.g. "ad-v2.mp4". Defaults to the file name.'),
       },
       async ({ file_path, name }) => {