viveworker 0.8.3 → 0.8.5

package/README.md

@@ -163,6 +163,8 @@ Use these commands most often:
   start `viveworker` again using the saved config
 - `npx viveworker stop`
   stop the local background service
+- `npx viveworker restart`
+  restart the local bridge using the saved config
 - `npx viveworker status`
   show the current app URL, launchd/background status, and health
 - `npx viveworker doctor`
@@ -266,6 +268,7 @@ What it supports:
 - PNG / JPG / GIF / WebP
 - CSV rendered as an HTML table by default
 - optional password protection
+- short-lived token URLs for password-protected shares
 - optional expiry
 
 HTML uploads are optimized by default when possible.
@@ -284,12 +287,21 @@ Typical commands:
 - `npx viveworker share upload report.pdf --password "hunter2" --expires-days 7`
 - `npx viveworker share upload deck_standalone.html --no-optimize`
 - `npx viveworker share list`
+- `npx viveworker share replace <slug> updated-report.html`
+- `npx viveworker share update <slug> --file updated-report.html`
 - `npx viveworker share update <slug> --password "hunter2"`
 - `npx viveworker share update <slug> --expires-days 7`
-- `npx viveworker share link <slug>`
+- `npx viveworker share link <slug> --password "hunter2" --ttl-hours 24`
 - `VIVEWORKER_BUYER_PRIVATE_KEY=0x... npx viveworker share pay https://share.viveworker.com/v/<slug> --output ./deliverable.pdf`
 - `npx viveworker share pay https://share.viveworker.com/v/<slug> --wallet hazbase --output ./deliverable.pdf`
 
+`share link` is for agent handoff. It verifies the current password locally with
+the File Share worker and returns a short-lived `https://share.viveworker.com/v/<slug>?t=<token>`
+URL, so the recipient can open the share without seeing the password. The token
+defaults to 24 hours, can be capped with `--ttl-hours` up to 720 hours, never
+outlives the share expiry, and is invalidated when you rotate the share password
+with `share update --password`.
+
 `share pay` is human-in-the-loop by default. EOA mode reads the x402 payment
 requirements and asks the paired device to approve before signing. `--wallet
 hazbase` instead sends the payment request to the paired device, asks for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viveworker",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Open mobile control surface for Codex, Claude, Thread Sharing, File Share, Moltbook, and A2A tasks on your trusted LAN.",
   "author": "Yuta Hoshino <hoshino.lireneo@gmail.com>",
   "license": "MIT",

package/scripts/mcp-server.mjs

@@ -146,6 +146,8 @@ async function callTool(params) {
       return toolOk(await toolRequestApproval(args));
     case "viveworker_share_file":
       return toolOk(await toolShareFile(args));
+    case "viveworker_share_link":
+      return toolOk(await toolShareLink(args));
     case "viveworker_thread_share":
       return toolOk(await toolThreadShare(args));
     case "viveworker_send_a2a_task":
@@ -199,6 +201,13 @@ async function toolShareFile(args) {
   const workspaceRoot = optionalString(args.workspaceRoot) || process.env.VIVEWORKER_MCP_WORKSPACE_ROOT || process.cwd();
   const file = await validateSharePath(requestedPath, workspaceRoot);
   const stat = await fs.stat(file.realPath);
+  const password = optionalString(args.password);
+  const expiresDays = optionalString(args.expiresDays ?? args["expires-days"]);
+  const tokenize = optionalBoolean(args.tokenize) || optionalBoolean(args.tokenizedUrl) || optionalBoolean(args.passwordlessUrl);
+  const tokenTtlHours = normalizeShareTokenTtlHours(args.tokenTtlHours ?? args["token-ttl-hours"] ?? args.ttlHours ?? args["ttl-hours"]);
+  if (tokenize && !password) {
+    throw rpcInvalidParams("tokenize requires password because tokenized URLs are minted from password-protected shares");
+  }
   const approval = await bridgeEvent({
     eventType: "approval_request",
     title: "Share file with viveworker File Share",
@@ -207,6 +216,8 @@ async function toolShareFile(args) {
       "",
       `File: ${file.displayPath}`,
       `Size: ${stat.size} bytes`,
+      password ? "Password gate: enabled" : "Password gate: disabled",
+      tokenize ? `Token URL: create short-lived passwordless ?t= URL${tokenTtlHours ? ` (${tokenTtlHours}h)` : " (24h)"}` : "",
       "",
       "Approve only if this file is safe to send outside this Mac.",
     ].join("\n"),
@@ -219,12 +230,52 @@ async function toolShareFile(args) {
   }
 
   const uploadArgs = ["share", "upload", file.realPath, "--json"];
-  const password = optionalString(args.password);
-  const expiresDays = optionalString(args.expiresDays ?? args["expires-days"]);
   if (password) uploadArgs.push("--password", password);
   if (expiresDays) uploadArgs.push("--expires-days", expiresDays);
   const upload = await runViveworkerCliJson(uploadArgs, 90_000);
-  return { approved: true, share: upload };
+  if (!tokenize) {
+    return { approved: true, share: upload };
+  }
+
+  const slug = optionalString(upload.slug) || slugFromShareUrl(upload.url);
+  if (!slug) {
+    throw new Error("share upload did not return a slug for tokenized URL creation");
+  }
+  const link = await createShareTokenLink(slug, password, tokenTtlHours);
+  return { approved: true, share: upload, tokenizedLink: link };
+}
+
+async function toolShareLink(args) {
+  const slug = requiredString(args.slug, "slug");
+  if (!/^[A-Za-z0-9]+$/.test(slug)) {
+    throw rpcInvalidParams("slug must contain only letters and numbers");
+  }
+  const password = requiredString(args.password, "password");
+  if (password.length > 256) {
+    throw rpcInvalidParams("password is too long (max 256 characters)");
+  }
+  const ttlHours = normalizeShareTokenTtlHours(args.ttlHours ?? args["ttl-hours"] ?? args.tokenTtlHours ?? args["token-ttl-hours"]);
+  const approval = await bridgeEvent({
+    eventType: "approval_request",
+    title: "Create File Share token link",
+    message: [
+      "An MCP client wants to mint a short-lived passwordless File Share URL.",
+      "",
+      `Share slug: ${slug}`,
+      `Token TTL: ${ttlHours || 24}h`,
+      "",
+      "Anyone with the returned ?t= URL can open this share until the token or share expires.",
+      "Approve only if you are comfortable handing off this password-protected share.",
+    ].join("\n"),
+    approvalKind: "file_share_link",
+    timeoutMs: clampTimeout(args.timeoutMs),
+  }, clampTimeout(args.timeoutMs));
+  if (!approval.approved) {
+    return { approved: false, decision: approval.decision || "rejected" };
+  }
+
+  const link = await createShareTokenLink(slug, password, ttlHours);
+  return { approved: true, link };
 }
 
 async function toolThreadShare(args) {
@@ -577,6 +628,43 @@ function normalizeStringArray(value) {
   return value.map((item) => String(item || "").trim()).filter(Boolean);
 }
 
+function optionalBoolean(value) {
+  if (value === true) return true;
+  if (value === false || value == null) return false;
+  const text = String(value).trim().toLowerCase();
+  return text === "1" || text === "true" || text === "yes" || text === "on";
+}
+
+function normalizeShareTokenTtlHours(value) {
+  if (value == null || value === "") return undefined;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0 || n > 720) {
+    throw rpcInvalidParams("token TTL must be a number between 1 and 720 hours");
+  }
+  return n;
+}
+
+function slugFromShareUrl(value) {
+  const text = optionalString(value);
+  if (!text) return "";
+  try {
+    const url = new URL(text);
+    const match = url.pathname.match(/^\/v\/([A-Za-z0-9]+)/u);
+    return match?.[1] || "";
+  } catch {
+    const match = text.match(/\/v\/([A-Za-z0-9]+)/u);
+    return match?.[1] || "";
+  }
+}
+
+async function createShareTokenLink(slug, password, ttlHours) {
+  const linkArgs = ["share", "link", slug, "--password", password, "--json"];
+  if (ttlHours !== undefined) {
+    linkArgs.push("--ttl-hours", String(ttlHours));
+  }
+  return runViveworkerCliJson(linkArgs, 30_000);
+}
+
 function requiredString(value, name) {
   const text = optionalString(value);
   if (!text) throw rpcInvalidParams(`${name} is required`);
@@ -789,7 +877,7 @@ const TOOLS = [
   {
     name: "viveworker_share_file",
     title: "Share file",
-    description: "After phone approval, upload a workspace file to viveworker File Share and return the limited URL.",
+    description: "After phone approval, upload a workspace file to viveworker File Share and return the limited URL. If password is set, pass tokenize=true to also mint a short-lived passwordless ?t= URL.",
     inputSchema: {
       type: "object",
       additionalProperties: false,
@@ -798,11 +886,29 @@ const TOOLS = [
         workspaceRoot: { type: "string" },
         password: { type: "string" },
         expiresDays: { type: "string" },
+        tokenize: { type: "boolean" },
+        tokenTtlHours: { type: "number" },
         timeoutMs: { type: "number" },
       },
       required: ["path"],
     },
   },
+  {
+    name: "viveworker_share_link",
+    title: "Create File Share token URL",
+    description: "After phone approval, mint a short-lived passwordless ?t= URL for an existing password-protected File Share slug.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        slug: { type: "string" },
+        password: { type: "string" },
+        ttlHours: { type: "number" },
+        timeoutMs: { type: "number" },
+      },
+      required: ["slug", "password"],
+    },
+  },
   {
     name: "viveworker_thread_share",
     title: "Thread share",
@@ -871,7 +977,7 @@ const PROMPTS = [
       title: "Share deliverable",
       description: "Package a local deliverable through viveworker File Share with phone approval.",
     },
-    text: "When the user asks to share a report, prototype, screenshot, CSV, or standalone HTML deliverable, use viveworker_share_file. Only share files inside the workspace and never share secrets or credentials.",
+    text: "When the user asks to share a report, prototype, screenshot, CSV, or standalone HTML deliverable, use viveworker_share_file. Only share files inside the workspace and never share secrets or credentials. If the user wants a password-protected share but the recipient should not know the password, set password plus tokenize=true, or use viveworker_share_link for an existing password-protected slug to mint a short-lived ?t= URL.",
   },
   {
     definition: {

package/scripts/share-cli.mjs

@@ -9,7 +9,8 @@
  * Commands:
  *   viveworker share upload <file> [--password <pw>] [--price <usd> --pay-to <0x…>] [--expires-days <n>] [--no-optimize] [--json]
  *   viveworker share list [--json]
- *   viveworker share update <slug> [--password <pw>] [--no-password] [--price <usd>] [--no-price] [--pay-to <0x…>] [--expires-days <n>] [--json]
+ *   viveworker share update <slug> [--file <file>] [--password <pw>] [--no-password] [--price <usd>] [--no-price] [--pay-to <0x…>] [--expires-days <n>] [--no-optimize] [--json]
+ *   viveworker share replace <slug> <file> [--expires-days <n>] [--no-optimize] [--json]
  *   viveworker share link <slug> --password <pw> [--ttl-hours <n>] [--json]
  *   viveworker share pay <url> [--output <file>] [--dry-run] [--wallet eoa|hazbase] [--no-approval] [--json]
  *   viveworker share delete <slug>
@@ -80,6 +81,8 @@ export async function runShareCli(args) {
       return handleList(args.slice(1));
     case "update":
       return handleUpdate(args.slice(1));
+    case "replace":
+      return handleReplace(args.slice(1));
     case "link":
       return handleLink(args.slice(1));
     case "pay":
@@ -99,7 +102,8 @@ function printHelp() {
   console.log("Commands:");
   console.log("  viveworker share upload <file> [--password <pw>] [--price <usd> --pay-to <0x…>] [--expires-days <n>] [--no-optimize] [--json]");
   console.log("  viveworker share list [--metrics] [--json]");
-  console.log("  viveworker share update <slug> [--password <pw>] [--no-password] [--price <usd>] [--no-price] [--pay-to <0x…>] [--expires-days <n>] [--json]");
+  console.log("  viveworker share update <slug> [--file <file>] [--password <pw>] [--no-password] [--price <usd>] [--no-price] [--pay-to <0x…>] [--expires-days <n>] [--no-optimize] [--json]");
+  console.log("  viveworker share replace <slug> <file> [--expires-days <n>] [--no-optimize] [--json]");
   console.log("  viveworker share link <slug> --password <pw> [--ttl-hours <n>] [--json]");
   console.log("  viveworker share pay <url> [--output <file>] [--dry-run] [--no-approval] [--json]");
   console.log("  viveworker share delete <slug>");
@@ -133,28 +137,6 @@ async function handleUpload(args) {
     throw new Error("Usage: viveworker share upload <file> [--password <pw>] [--expires-days <n>]");
   }
 
-  const absolute = path.resolve(filePath);
-  let stat;
-  try {
-    stat = await fs.stat(absolute);
-  } catch {
-    throw new Error(`File not found: ${filePath}`);
-  }
-  if (!stat.isFile()) {
-    throw new Error(`Not a regular file: ${filePath}`);
-  }
-  if (stat.size === 0) {
-    throw new Error(`File is empty: ${filePath}`);
-  }
-  const ext = path.extname(absolute).toLowerCase();
-  if (!ALLOWED_EXTENSIONS.includes(ext)) {
-    throw new Error(
-      `Accepted file types: ${ALLOWED_EXTENSIONS.join(" / ")}. ` +
-      `Got: ${ext || "(no extension)"}`
-    );
-  }
-  const { mime } = SHARE_TYPES[ext];
-
   const password = flags["password"] || "";
   const expiresDays = flags["expires-days"] || flags["expiresDays"] || "";
   const price = flags["price"] || "";
@@ -190,21 +172,10 @@ async function handleUpload(args) {
 
   const { apiKey, userId, shareUrl } = await resolveCredentials();
 
-  const originalBytes = await fs.readFile(absolute);
-  const optimization =
-    flags["no-optimize"] || flags["noOptimize"]
-      ? { bytes: originalBytes, info: null }
-      : maybeOptimizeUpload({ absolute, ext, bytes: originalBytes });
-  const bytes = optimization.bytes;
-  if (bytes.length > MAX_FILE_SIZE) {
-    const detail = optimization.info
-      ? ` after optimization to ${formatSize(bytes.length)}`
-      : "";
-    throw new Error(`File too large (${originalBytes.length} bytes, max ${MAX_FILE_SIZE})${detail}`);
-  }
+  const preparedFile = await prepareShareFile(filePath, flags);
   const form = new FormData();
-  const blob = new Blob([bytes], { type: mime });
-  const file = new File([blob], path.basename(absolute), { type: mime });
+  const blob = new Blob([preparedFile.bytes], { type: preparedFile.mime });
+  const file = new File([blob], path.basename(preparedFile.absolute), { type: preparedFile.mime });
   form.set("file", file);
   if (password) form.set("password", password);
   if (expiresDays) form.set("expiresDays", String(expiresDays));
@@ -233,14 +204,14 @@ async function handleUpload(args) {
   }
 
   console.log("");
-  console.log(`✅ Uploaded ${body.originalName || path.basename(absolute)} (${formatSize(body.size)})`);
+  console.log(`✅ Uploaded ${body.originalName || path.basename(preparedFile.absolute)} (${formatSize(body.size)})`);
   console.log("");
-  if (optimization.info) {
+  if (preparedFile.optimization.info) {
     console.log(
-      `   Optimized HTML: ${formatSize(optimization.info.originalBytes)} → ${formatSize(optimization.info.optimizedBytes)}`
+      `   Optimized HTML: ${formatSize(preparedFile.optimization.info.originalBytes)} → ${formatSize(preparedFile.optimization.info.optimizedBytes)}`
     );
     console.log(
-      `   Removed embedded fonts: ${optimization.info.removedFonts}`
+      `   Removed embedded fonts: ${preparedFile.optimization.info.removedFonts}`
     );
     console.log("");
   }
@@ -262,6 +233,44 @@ async function handleUpload(args) {
   console.log("");
 }
 
+async function prepareShareFile(filePath, flags = {}) {
+  const absolute = path.resolve(String(filePath || ""));
+  let stat;
+  try {
+    stat = await fs.stat(absolute);
+  } catch {
+    throw new Error(`File not found: ${filePath}`);
+  }
+  if (!stat.isFile()) {
+    throw new Error(`Not a regular file: ${filePath}`);
+  }
+  if (stat.size === 0) {
+    throw new Error(`File is empty: ${filePath}`);
+  }
+  const ext = path.extname(absolute).toLowerCase();
+  if (!ALLOWED_EXTENSIONS.includes(ext)) {
+    throw new Error(
+      `Accepted file types: ${ALLOWED_EXTENSIONS.join(" / ")}. ` +
+      `Got: ${ext || "(no extension)"}`
+    );
+  }
+  const { mime } = SHARE_TYPES[ext];
+  const originalBytes = await fs.readFile(absolute);
+  const optimization =
+    flags["no-optimize"] || flags["noOptimize"]
+      ? { bytes: originalBytes, info: null }
+      : maybeOptimizeUpload({ absolute, ext, bytes: originalBytes });
+  const bytes = optimization.bytes;
+  if (bytes.length > MAX_FILE_SIZE) {
+    const detail = optimization.info
+      ? ` after optimization to ${formatSize(bytes.length)}`
+      : "";
+    throw new Error(`File too large (${originalBytes.length} bytes, max ${MAX_FILE_SIZE})${detail}`);
+  }
+
+  return { absolute, ext, mime, bytes, optimization };
+}
+
 function maybeOptimizeUpload({ absolute, ext, bytes }) {
   if (ext !== ".html" && ext !== ".htm") {
     return { bytes, info: null };
@@ -506,15 +515,34 @@ function printMetricsSection(metrics, err) {
 
 async function handleUpdate(args) {
   const flags = parseFlags(args);
+  return handleUpdateWithFlags(flags, "update");
+}
+
+async function handleReplace(args) {
+  const flags = parseFlags(args);
+  const slug = flags._[0];
+  const filePath = flags._[1] || flags.file || flags.f;
+  if (!slug || !filePath || flags._.length > 2) {
+    throw new Error("Usage: viveworker share replace <slug> <file> [--expires-days <n>] [--no-optimize] [--json]");
+  }
+  flags._ = [slug];
+  flags.file = filePath;
+  return handleUpdateWithFlags(flags, "replace");
+}
+
+async function handleUpdateWithFlags(flags, mode = "update") {
   const slug = flags._[0];
   if (!slug) {
     throw new Error(
-      "Usage: viveworker share update <slug> [--password <pw>] [--no-password] [--price <usd>] [--no-price] [--pay-to <0x…>] [--expires-days <n>]"
+      "Usage: viveworker share update <slug> [--file <file>] [--password <pw>] [--no-password] [--price <usd>] [--no-price] [--pay-to <0x…>] [--expires-days <n>] [--no-optimize]"
     );
   }
   if (!/^[A-Za-z0-9]+$/.test(slug)) {
     throw new Error(`Invalid slug: ${slug}`);
   }
+  if (flags._.length > 1) {
+    throw new Error("Unexpected positional argument. Use `share replace <slug> <file>` or `share update <slug> --file <file>`.");
+  }
 
   const hasPassword = Object.prototype.hasOwnProperty.call(flags, "password");
   const hasNoPassword = Object.prototype.hasOwnProperty.call(flags, "no-password");
@@ -525,6 +553,9 @@ async function handleUpdate(args) {
     Object.prototype.hasOwnProperty.call(flags, "noPrice");
   const hasPayTo = Object.prototype.hasOwnProperty.call(flags, "pay-to") ||
     Object.prototype.hasOwnProperty.call(flags, "payTo");
+  const hasFile = Object.prototype.hasOwnProperty.call(flags, "file") ||
+    Object.prototype.hasOwnProperty.call(flags, "f");
+  const filePath = flags.file || flags.f || "";
 
   if (hasPassword && hasNoPassword) {
     throw new Error("Pass either --password OR --no-password, not both");
@@ -535,9 +566,12 @@ async function handleUpdate(args) {
   if (hasPrice && hasPassword) {
     throw new Error("--price and --password cannot be combined on a single share");
   }
-  if (!hasPassword && !hasNoPassword && !hasExpires && !hasPrice && !hasNoPrice && !hasPayTo) {
+  if (hasFile && (typeof filePath !== "string" || filePath.length === 0)) {
+    throw new Error("--file requires a path");
+  }
+  if (!hasPassword && !hasNoPassword && !hasExpires && !hasPrice && !hasNoPrice && !hasPayTo && !hasFile) {
     throw new Error(
-      "Nothing to update — specify at least one of --password <pw>, --no-password, --price <usd>, --no-price, --pay-to <0x…>, --expires-days <n>"
+      "Nothing to update — specify at least one of --file <file>, --password <pw>, --no-password, --price <usd>, --no-price, --pay-to <0x…>, --expires-days <n>"
     );
   }
 
@@ -603,19 +637,44 @@ async function handleUpdate(args) {
 
   const { apiKey, userId, shareUrl } = await resolveCredentials();
 
-  const res = await fetchWithTimeout(`${shareUrl}/api/share/${encodeURIComponent(slug)}`, {
-    method: "PATCH",
-    headers: {
+  let preparedFile = null;
+  let requestBody;
+  let requestHeaders;
+  let timeoutMs;
+  if (hasFile) {
+    preparedFile = await prepareShareFile(filePath, flags);
+    const form = new FormData();
+    const blob = new Blob([preparedFile.bytes], { type: preparedFile.mime });
+    const file = new File([blob], path.basename(preparedFile.absolute), { type: preparedFile.mime });
+    form.set("file", file);
+    for (const [key, value] of Object.entries(body)) {
+      form.set(key, value === null ? "" : String(value));
+    }
+    requestBody = form;
+    requestHeaders = {
+      "x-a2a-user": userId,
+      "x-a2a-key": apiKey,
+    };
+    timeoutMs = 60_000;
+  } else {
+    requestBody = JSON.stringify(body);
+    requestHeaders = {
       "content-type": "application/json",
       "x-a2a-user": userId,
       "x-a2a-key": apiKey,
-    },
-    body: JSON.stringify(body),
-  }, 30_000);
+    };
+    timeoutMs = 30_000;
+  }
+
+  const res = await fetchWithTimeout(`${shareUrl}/api/share/${encodeURIComponent(slug)}`, {
+    method: "PATCH",
+    headers: requestHeaders,
+    body: requestBody,
+  }, timeoutMs);
 
   const respBody = await readJson(res);
   if (!res.ok || respBody.error) {
-    throw new Error(formatApiError("Update", res.status, respBody));
+    throw new Error(formatApiError(mode === "replace" ? "Replace" : "Update", res.status, respBody));
   }
 
   if (flags.json) {
@@ -624,17 +683,25 @@ async function handleUpdate(args) {
   }
 
   console.log("");
-  console.log(`✅ Updated ${slug}`);
+  console.log(hasFile ? `✅ Replaced file for ${slug}` : `✅ Updated ${slug}`);
   console.log("");
   console.log(`   ${respBody.url}`);
   console.log("");
+  if (hasFile) {
+    console.log(`   File: ${respBody.originalName || path.basename(preparedFile.absolute)} (${formatSize(respBody.size || preparedFile.bytes.length)})`);
+    if (preparedFile.optimization.info) {
+      console.log(
+        `   Optimized HTML: ${formatSize(preparedFile.optimization.info.originalBytes)} → ${formatSize(preparedFile.optimization.info.optimizedBytes)}`
+      );
+    }
+  }
   if (respBody.hasPassword) {
     console.log(`   🔒 Password-protected${hasPassword ? " (existing unlock cookies invalidated)" : ""}`);
   } else if (hasNoPassword) {
     console.log(`   🔓 Password removed`);
   }
   if (respBody.price && respBody.payTo) {
-    const rotated = hasPrice ? " (paid sessions invalidated)" : "";
+    const rotated = hasPrice || respBody.paymentSessionsInvalidated ? " (paid sessions invalidated)" : "";
     console.log(
       `   💰 Paid — ${formatUsdc(respBody.price)} USDC on ${respBody.network || "?"} → ${respBody.payTo}${rotated}`
     );
@@ -652,7 +719,7 @@ async function handleUpdate(args) {
 // password-protected share to another agent without disclosing the password.
 //
 // The owner keeps the password on their side; the receiver only needs to GET
-// the returned URL. Tokens default to 24h, capped at 168h (7d) and capped by
+// the returned URL. Tokens default to 24h, capped at 720h (30d) and capped by
 // the share's own `expiresAtMs`. Rotating the password via `share update
 // --password ...` invalidates every outstanding token for the slug.
 // ---------------------------------------------------------------------------
@@ -681,8 +748,8 @@ async function handleLink(args) {
   if (hasTtl) {
     const raw = flags["ttl-hours"] || flags["ttlHours"];
     const n = Number(raw);
-    if (!Number.isFinite(n) || n <= 0 || n > 168) {
-      throw new Error("--ttl-hours must be a number between 1 and 168");
+    if (!Number.isFinite(n) || n <= 0 || n > 720) {
+      throw new Error("--ttl-hours must be a number between 1 and 720");
     }
     ttlHours = n;
   }
@@ -1181,6 +1248,12 @@ function formatApiError(op, status, body) {
       return `${op} failed (${status}): file count exceeded — ${body.current}/${body.max}. Delete something first.`;
     case "file-too-large":
       return `${op} failed (${status}): file too large (max ${formatSize(body.maxBytes)})`;
+    case "empty-file":
+      return `${op} failed (${status}): file is empty`;
+    case "invalid-form-data":
+      return `${op} failed (${status}): invalid multipart form data`;
+    case "invalid-file-field":
+      return `${op} failed (${status}): invalid file field`;
     case "unsupported-extension":
       return `${op} failed (${status}): unsupported file type. Accepted: ${(body.allowed || []).join(" / ") || "n/a"}`;
     case "unsupported-content-type":
@@ -1196,7 +1269,7 @@ function formatApiError(op, status, body) {
     case "not-password-protected":
       return `${op} failed (${status}): share has no password — no link token needed, just share the URL directly`;
     case "invalid-ttlHours":
-      return `${op} failed (${status}): --ttl-hours must be between 1 and ${body.maxHours || 168}`;
+      return `${op} failed (${status}): --ttl-hours must be between 1 and ${body.maxHours || 720}`;
     // x402 / paid-share error codes — thrown by the worker on upload,
     // PATCH, or view. Keep the messages actionable; agents read these
     // back to the user verbatim.

package/scripts/viveworker-bridge.mjs

@@ -9631,6 +9631,15 @@ function isStartTurnAckTimeout(errorValue) {
     message === "turn/start-timeout";
 }
 
+function isIpcNoClientFoundError(errorValue) {
+  const message = normalizeIpcErrorMessage(errorValue).toLowerCase();
+  return message === "no-client-found" ||
+    message === "client-not-found" ||
+    message === "target-client-not-found" ||
+    message.includes("no client found") ||
+    message.includes("client not found");
+}
+
 function buildDefaultCollaborationMode(threadState) {
   // Fallback turns must leave Plan mode unless the caller explicitly opts in.
   return buildRequestedCollaborationMode(threadState, "default");
@@ -9749,14 +9758,36 @@ class NativeIpcClient {
     );
   }
 
-  sendThreadFollowerRequest(method, params, conversationId, ownerClientId = null, options = {}) {
-    return this.sendRequest(method, params, {
-      targetClientId:
-        ownerClientId ??
-        this.runtime.threadOwnerClientIds.get(conversationId) ??
-        null,
-      ...options,
-    });
+  async sendThreadFollowerRequest(method, params, conversationId, ownerClientId = null, options = {}) {
+    const targetClientId =
+      ownerClientId ??
+      this.runtime.threadOwnerClientIds.get(conversationId) ??
+      null;
+
+    try {
+      return await this.sendRequest(method, params, {
+        targetClientId,
+        ...options,
+      });
+    } catch (error) {
+      if (!targetClientId || !isIpcNoClientFoundError(error)) {
+        throw error;
+      }
+
+      const mappedOwner = this.runtime.threadOwnerClientIds.get(conversationId) ?? null;
+      if (mappedOwner === targetClientId) {
+        this.runtime.threadOwnerClientIds.delete(conversationId);
+      }
+      console.warn(
+        `[ipc] stale owner client for thread=${cleanText(conversationId || "") || "unknown"} ` +
+        `target=${cleanText(targetClientId || "") || "unknown"} method=${cleanText(method || "") || "unknown"}; retrying without target`
+      );
+
+      return this.sendRequest(method, params, {
+        ...options,
+        targetClientId: null,
+      });
+    }
   }
 
   sendRequest(method, params, options = {}) {
@@ -19041,6 +19072,9 @@ if (url.pathname === "/api/hazbase/logout" && req.method === "POST") {
           if (error.message === "codex-ipc-not-connected") {
             return writeJson(res, 503, { error: error.message });
           }
+          if (isIpcNoClientFoundError(error)) {
+            return writeJson(res, 503, { error: "codex-client-not-found" });
+          }
           return writeJson(res, 500, { error: error.message });
         }
       }

package/scripts/viveworker.mjs

@@ -115,6 +115,9 @@ async function main(cliOptions) {
     case "stop":
       await runStop(cliOptions);
       return;
+    case "restart":
+      await runRestart(cliOptions);
+      return;
     case "status":
       await runStatus(cliOptions);
       return;
@@ -1181,6 +1184,11 @@ async function runStop(cliOptions) {
   ]);
 }
 
+async function runRestart(cliOptions) {
+  await runStop(cliOptions);
+  await runStart(cliOptions);
+}
+
 async function runStatus(cliOptions) {
   const configDir = resolvePath(cliOptions.configDir || defaultConfigDir);
   const envFile = resolvePath(cliOptions.envFile || path.join(configDir, "config.env"));
@@ -1834,6 +1842,7 @@ ${t(locale, "cli.help.commands")}
   ${t(locale, "cli.help.enable")}
   ${t(locale, "cli.help.start")}
   ${t(locale, "cli.help.stop")}
+  ${t(locale, "cli.help.restart")}
   ${t(locale, "cli.help.status")}
   ${t(locale, "cli.help.doctor")}
   ${t(locale, "cli.help.update")}

package/templates/CLAUDE.viveworker.md

@@ -26,7 +26,8 @@ Then restart the Claude Code session. If the tools are not available, ask the us
 - `viveworker_notify` sends an informational phone notification and records a timeline entry.
 - `viveworker_ask` asks the paired phone a question and waits for the answer.
 - `viveworker_request_approval` asks the phone to approve or reject a proposed action.
-- `viveworker_share_file` uploads a workspace file to File Share after phone approval.
+- `viveworker_share_file` uploads a workspace file to File Share after phone approval. For password-protected handoff, pass `tokenize: true` to return a short-lived passwordless `?t=` URL.
+- `viveworker_share_link` mints a short-lived passwordless `?t=` URL for an existing password-protected File Share slug after phone approval.
 - `viveworker_thread_share` shares context into another Codex / Claude / inbox thread.
 - `viveworker_send_a2a_task` sends a task to a registered A2A target after phone approval.
 
@@ -35,6 +36,7 @@ Then restart the Claude Code session. If the tools are not available, ask the us
 - If the user says "ask me on my phone", "スマホに聞いて", or a short decision blocks progress, use `viveworker_ask`.
 - If the user asks you to proceed with a risky, external, irreversible, payment-related, or user-visible action, use `viveworker_request_approval`.
 - If the user asks for a report, prototype, screenshot, PDF, CSV, or standalone HTML to become a shareable link, use `viveworker_share_file`.
+- If the user asks for a password-protected share but wants the recipient to open it without knowing the password, use `viveworker_share_file` with `password` and `tokenize: true`, or use `viveworker_share_link` for an existing slug.
 - If the user says "share this with Codex/Claude", "Aの内容をBに共有して", or wants context handed to another session, use `viveworker_thread_share`.
 - If the user wants another registered agent to do work, use `viveworker_send_a2a_task`.
 

package/web/app.js

@@ -43,6 +43,7 @@ const DETAIL_REFRESH_FALLBACK_TIMEOUT_MS = 2_500;
 const DETAIL_STICKY_LAN_PROBE_TIMEOUT_MS = 350;
 const COMPLETION_REPLY_SEND_TIMEOUT_MS = 22_000;
 const COMPLETION_REPLY_OPTIMISTIC_SENT_MS = 1_600;
+const LAN_FETCH_TIMEOUT_MESSAGE = "LAN fetch timed out";
 const TIMELINE_REFRESH_TIMEOUT_MS = 8_000;
 const TIMELINE_POLL_TIMEOUT_MS = 4_500;
 const FAST_POLL_STEP_TIMEOUT_MS = 4_500;
@@ -2755,6 +2756,11 @@ function completionReplyWarningMatchesSentText(error, text, attachmentCount = 0)
   return Boolean(warningText && sentText && warningText === sentText);
 }
 
+function isCompletionReplyLateNetworkResult(error) {
+  return error?.errorKey === "request-timeout" ||
+    error?.message === LAN_FETCH_TIMEOUT_MESSAGE;
+}
+
 function normalizeCompletionReplyAttachments(values) {
   const rawValues = Array.isArray(values)
     ? values
@@ -10027,7 +10033,7 @@ for (const button of document.querySelectorAll("[data-wallet-address-copy]")) {
       } catch (error) {
         const optimisticDraft = getCompletionReplyDraft(token);
         if (
-          error.errorKey === "request-timeout" &&
+          isCompletionReplyLateNetworkResult(error) &&
           optimisticDraft.collapsedAfterSend &&
           optimisticDraft.sentText === text
         ) {
@@ -11504,6 +11510,7 @@ function localizeApiError(value) {
     "completion-reply-image-limit": "error.completionReplyImageLimit",
     "completion-reply-image-invalid-upload": "error.completionReplyImageInvalidUpload",
     "codex-ipc-not-connected": "error.codexIpcNotConnected",
+    "codex-client-not-found": "error.codexClientNotFound",
     "approval-not-found": "error.approvalNotFound",
     "approval-already-handled": "error.approvalAlreadyHandled",
     "plan-request-not-found": "error.planRequestNotFound",

package/web/build-id.js

@@ -1 +1 @@
-export const APP_BUILD_ID = "20260509-remote-lan-relay-guard";
+export const APP_BUILD_ID = "20260514-lan-timeout-reply-ack";

package/web/i18n.js

@@ -758,6 +758,7 @@ const translations = {
     "error.completionReplyImageLimit": "Attach up to {count} images at a time.",
     "error.completionReplyImageInvalidUpload": "That image could not be uploaded.",
     "error.codexIpcNotConnected": "Codex desktop is not connected right now.",
+    "error.codexClientNotFound": "Codex changed its active client. Reopen the thread on your PC and try again.",
     "error.approvalNotFound": "This approval is no longer available.",
     "error.approvalAlreadyHandled": "This approval was already handled.",
     "error.planRequestNotFound": "This plan request is no longer available.",
@@ -884,13 +885,14 @@ const translations = {
     "server.page.choiceMissing": "Choice input token not found",
     "server.page.approvalHandled": "Approval already handled",
     "server.page.detailMissing": "Completion detail not found",
-    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|status|doctor|update> [options]",
+    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|restart|status|doctor|update> [options]",
     "cli.help.commands": "Commands:",
     "cli.help.setup": "setup         Create config, register launchd, and start the base viveworker bridge",
     "cli.help.pair": "pair          Refresh pairing info for another trusted device",
     "cli.help.enable": "enable        Enable an optional integration or feature",
     "cli.help.start": "start         Start the bridge using the saved config",
     "cli.help.stop": "stop          Stop the bridge",
+    "cli.help.restart": "restart       Restart the bridge using the saved config",
     "cli.help.status": "status        Print launchd/background status and health",
     "cli.help.doctor": "doctor        Diagnose the local setup",
     "cli.help.update": "update        Update to the latest version and restart all services",
@@ -1835,6 +1837,7 @@ const translations = {
     "error.completionReplyImageLimit": "画像は最大 {count} 枚まで添付できます。",
     "error.completionReplyImageInvalidUpload": "この画像はアップロードできませんでした。",
     "error.codexIpcNotConnected": "いまは Codex desktop に接続できていません。",
+    "error.codexClientNotFound": "Codex 側の接続先が切り替わりました。PC で対象スレッドを開き直して、もう一度送信してください。",
     "error.approvalNotFound": "この承認はもう利用できません。",
     "error.approvalAlreadyHandled": "この承認はすでに処理済みです。",
     "error.planRequestNotFound": "このプラン確認はもう利用できません。",
@@ -1961,13 +1964,14 @@ const translations = {
     "server.page.choiceMissing": "選択入力トークンが見つかりません",
     "server.page.approvalHandled": "この承認はすでに処理済みです",
     "server.page.detailMissing": "完了詳細が見つかりません",
-    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|status|doctor|update> [options]",
+    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|restart|status|doctor|update> [options]",
     "cli.help.commands": "Commands:",
     "cli.help.setup": "setup         base の設定を作成し、launchd に登録して viveworker bridge を起動します",
     "cli.help.pair": "pair          追加する信頼済み端末向けに pairing 情報を更新します",
     "cli.help.enable": "enable        オプション機能や連携を有効化します",
     "cli.help.start": "start         保存済み設定で bridge を起動します",
     "cli.help.stop": "stop          bridge を停止します",
+    "cli.help.restart": "restart       保存済み設定で bridge を再起動します",
     "cli.help.status": "status        launchd / バックグラウンド状態と health を表示します",
     "cli.help.doctor": "doctor        ローカル設定を診断します",
     "cli.help.update": "update        最新バージョンに更新し、全サービスを再起動します",

package/web/remote-pairing/transport.js

@@ -88,6 +88,7 @@ const DEFAULT_FAILURE_WINDOW_MS = 60_000;
 const DEFAULT_FAILURE_THRESHOLD = 4;
 const DEFAULT_CIRCUIT_BREAKER_MS = 60_000;
 const DEFAULT_MAX_CIRCUIT_BREAKER_MS = 10 * 60_000;
+const DEFAULT_STABLE_CONNECTION_MS = 15_000;
 const DEFAULT_PROLOGUE = new TextEncoder().encode("viveworker/remote-pairing/v1");
 
 // CloseEvent codes we emit. 1000 is normal; 4xxx is application-defined.
@@ -121,6 +122,7 @@ const CLOSE_RELAY_RESET_SESSION = 4004;
  * @property {number} [failureThreshold]
  * @property {number} [circuitBreakerMs]
  * @property {number} [maxCircuitBreakerMs]
+ * @property {number} [stableConnectionMs]
  * @property {typeof WebSocket} [WebSocketImpl]     injectable for Node-side tests
  * @property {{debug?: Function, warn?: Function}} [logger]
  */
@@ -166,6 +168,7 @@ export class RemotePairingTransport {
     this._failureThreshold = opts.failureThreshold ?? DEFAULT_FAILURE_THRESHOLD;
     this._circuitBreakerMs = opts.circuitBreakerMs ?? DEFAULT_CIRCUIT_BREAKER_MS;
     this._maxCircuitBreakerMs = opts.maxCircuitBreakerMs ?? DEFAULT_MAX_CIRCUIT_BREAKER_MS;
+    this._stableConnectionMs = opts.stableConnectionMs ?? DEFAULT_STABLE_CONNECTION_MS;
 
     this._WebSocketImpl = opts.WebSocketImpl ?? globalThis.WebSocket;
     if (typeof this._WebSocketImpl !== "function") {
@@ -200,6 +203,8 @@ export class RemotePairingTransport {
     this._pingTimer = null;
     /** @type {ReturnType<typeof setTimeout> | null} */
     this._handshakeTimer = null;
+    /** @type {ReturnType<typeof setTimeout> | null} */
+    this._stableConnectionTimer = null;
     /** @type {number[]} recent reconnect-triggering failures. */
     this._recentFailureAtMs = [];
     /** If > Date.now(), reconnect attempts are intentionally delayed. */
@@ -317,6 +322,7 @@ export class RemotePairingTransport {
     this._closed = true;
     this._started = false;
     this._cancelReconnectTimer();
+    this._cancelStableConnectionTimer();
     this._stopPing();
     this._stopHandshakeTimer();
     if (this._ws) {
@@ -682,6 +688,24 @@ export class RemotePairingTransport {
     }
   }
 
+  _scheduleStableConnectionReset() {
+    const delay = Math.max(0, Number(this._stableConnectionMs) || 0);
+    this._stableConnectionTimer = setTimeout(() => {
+      this._stableConnectionTimer = null;
+      if (this._closed || this._state !== STATE.CONNECTED) return;
+      this._recentFailureAtMs = [];
+      this._circuitOpenUntilMs = 0;
+      this._circuitOpenCount = 0;
+    }, delay);
+  }
+
+  _cancelStableConnectionTimer() {
+    if (this._stableConnectionTimer != null) {
+      clearTimeout(this._stableConnectionTimer);
+      this._stableConnectionTimer = null;
+    }
+  }
+
   _startPing() {
     this._stopPing();
     this._pingTimer = setInterval(() => {
@@ -742,11 +766,10 @@ export class RemotePairingTransport {
     if (this._state === newState) return;
     const prev = this._state;
     this._state = newState;
+    this._cancelStableConnectionTimer();
     if (newState === STATE.CONNECTED) {
       this._reconnectAttempt = 0;
-      this._recentFailureAtMs = [];
-      this._circuitOpenUntilMs = 0;
-      this._circuitOpenCount = 0;
+      this._scheduleStableConnectionReset();
     }
     try {
       this._onStateChange(newState, prev, info);
@@ -771,6 +794,7 @@ export class RemotePairingTransport {
     this._stopPing();
     this._stopHandshakeTimer();
     this._cancelReconnectTimer();
+    this._cancelStableConnectionTimer();
     if (this._ws) {
       try { this._ws.close(CLOSE_FATAL, "fatal-error"); } catch {}
       this._ws = null;