viveworker 0.8.4 → 0.8.5

package/README.md

@@ -163,6 +163,8 @@ Use these commands most often:
   start `viveworker` again using the saved config
 - `npx viveworker stop`
   stop the local background service
+- `npx viveworker restart`
+  restart the local bridge using the saved config
 - `npx viveworker status`
   show the current app URL, launchd/background status, and health
 - `npx viveworker doctor`
@@ -266,6 +268,7 @@ What it supports:
 - PNG / JPG / GIF / WebP
 - CSV rendered as an HTML table by default
 - optional password protection
+- short-lived token URLs for password-protected shares
 - optional expiry
 
 HTML uploads are optimized by default when possible.
@@ -288,10 +291,17 @@ Typical commands:
 - `npx viveworker share update <slug> --file updated-report.html`
 - `npx viveworker share update <slug> --password "hunter2"`
 - `npx viveworker share update <slug> --expires-days 7`
-- `npx viveworker share link <slug>`
+- `npx viveworker share link <slug> --password "hunter2" --ttl-hours 24`
 - `VIVEWORKER_BUYER_PRIVATE_KEY=0x... npx viveworker share pay https://share.viveworker.com/v/<slug> --output ./deliverable.pdf`
 - `npx viveworker share pay https://share.viveworker.com/v/<slug> --wallet hazbase --output ./deliverable.pdf`
 
+`share link` is for agent handoff. It verifies the current password locally with
+the File Share worker and returns a short-lived `https://share.viveworker.com/v/<slug>?t=<token>`
+URL, so the recipient can open the share without seeing the password. The token
+defaults to 24 hours, can be capped with `--ttl-hours` up to 720 hours, never
+outlives the share expiry, and is invalidated when you rotate the share password
+with `share update --password`.
+
 `share pay` is human-in-the-loop by default. EOA mode reads the x402 payment
 requirements and asks the paired device to approve before signing. `--wallet
 hazbase` instead sends the payment request to the paired device, asks for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viveworker",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Open mobile control surface for Codex, Claude, Thread Sharing, File Share, Moltbook, and A2A tasks on your trusted LAN.",
   "author": "Yuta Hoshino <hoshino.lireneo@gmail.com>",
   "license": "MIT",

package/scripts/mcp-server.mjs

@@ -146,6 +146,8 @@ async function callTool(params) {
       return toolOk(await toolRequestApproval(args));
     case "viveworker_share_file":
       return toolOk(await toolShareFile(args));
+    case "viveworker_share_link":
+      return toolOk(await toolShareLink(args));
     case "viveworker_thread_share":
       return toolOk(await toolThreadShare(args));
     case "viveworker_send_a2a_task":
@@ -199,6 +201,13 @@ async function toolShareFile(args) {
   const workspaceRoot = optionalString(args.workspaceRoot) || process.env.VIVEWORKER_MCP_WORKSPACE_ROOT || process.cwd();
   const file = await validateSharePath(requestedPath, workspaceRoot);
   const stat = await fs.stat(file.realPath);
+  const password = optionalString(args.password);
+  const expiresDays = optionalString(args.expiresDays ?? args["expires-days"]);
+  const tokenize = optionalBoolean(args.tokenize) || optionalBoolean(args.tokenizedUrl) || optionalBoolean(args.passwordlessUrl);
+  const tokenTtlHours = normalizeShareTokenTtlHours(args.tokenTtlHours ?? args["token-ttl-hours"] ?? args.ttlHours ?? args["ttl-hours"]);
+  if (tokenize && !password) {
+    throw rpcInvalidParams("tokenize requires password because tokenized URLs are minted from password-protected shares");
+  }
   const approval = await bridgeEvent({
     eventType: "approval_request",
     title: "Share file with viveworker File Share",
@@ -207,6 +216,8 @@ async function toolShareFile(args) {
       "",
       `File: ${file.displayPath}`,
       `Size: ${stat.size} bytes`,
+      password ? "Password gate: enabled" : "Password gate: disabled",
+      tokenize ? `Token URL: create short-lived passwordless ?t= URL${tokenTtlHours ? ` (${tokenTtlHours}h)` : " (24h)"}` : "",
       "",
       "Approve only if this file is safe to send outside this Mac.",
     ].join("\n"),
@@ -219,12 +230,52 @@ async function toolShareFile(args) {
   }
 
   const uploadArgs = ["share", "upload", file.realPath, "--json"];
-  const password = optionalString(args.password);
-  const expiresDays = optionalString(args.expiresDays ?? args["expires-days"]);
   if (password) uploadArgs.push("--password", password);
   if (expiresDays) uploadArgs.push("--expires-days", expiresDays);
   const upload = await runViveworkerCliJson(uploadArgs, 90_000);
-  return { approved: true, share: upload };
+  if (!tokenize) {
+    return { approved: true, share: upload };
+  }
+
+  const slug = optionalString(upload.slug) || slugFromShareUrl(upload.url);
+  if (!slug) {
+    throw new Error("share upload did not return a slug for tokenized URL creation");
+  }
+  const link = await createShareTokenLink(slug, password, tokenTtlHours);
+  return { approved: true, share: upload, tokenizedLink: link };
+}
+
+async function toolShareLink(args) {
+  const slug = requiredString(args.slug, "slug");
+  if (!/^[A-Za-z0-9]+$/.test(slug)) {
+    throw rpcInvalidParams("slug must contain only letters and numbers");
+  }
+  const password = requiredString(args.password, "password");
+  if (password.length > 256) {
+    throw rpcInvalidParams("password is too long (max 256 characters)");
+  }
+  const ttlHours = normalizeShareTokenTtlHours(args.ttlHours ?? args["ttl-hours"] ?? args.tokenTtlHours ?? args["token-ttl-hours"]);
+  const approval = await bridgeEvent({
+    eventType: "approval_request",
+    title: "Create File Share token link",
+    message: [
+      "An MCP client wants to mint a short-lived passwordless File Share URL.",
+      "",
+      `Share slug: ${slug}`,
+      `Token TTL: ${ttlHours || 24}h`,
+      "",
+      "Anyone with the returned ?t= URL can open this share until the token or share expires.",
+      "Approve only if you are comfortable handing off this password-protected share.",
+    ].join("\n"),
+    approvalKind: "file_share_link",
+    timeoutMs: clampTimeout(args.timeoutMs),
+  }, clampTimeout(args.timeoutMs));
+  if (!approval.approved) {
+    return { approved: false, decision: approval.decision || "rejected" };
+  }
+
+  const link = await createShareTokenLink(slug, password, ttlHours);
+  return { approved: true, link };
 }
 
 async function toolThreadShare(args) {
@@ -577,6 +628,43 @@ function normalizeStringArray(value) {
   return value.map((item) => String(item || "").trim()).filter(Boolean);
 }
 
+function optionalBoolean(value) {
+  if (value === true) return true;
+  if (value === false || value == null) return false;
+  const text = String(value).trim().toLowerCase();
+  return text === "1" || text === "true" || text === "yes" || text === "on";
+}
+
+function normalizeShareTokenTtlHours(value) {
+  if (value == null || value === "") return undefined;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0 || n > 720) {
+    throw rpcInvalidParams("token TTL must be a number between 1 and 720 hours");
+  }
+  return n;
+}
+
+function slugFromShareUrl(value) {
+  const text = optionalString(value);
+  if (!text) return "";
+  try {
+    const url = new URL(text);
+    const match = url.pathname.match(/^\/v\/([A-Za-z0-9]+)/u);
+    return match?.[1] || "";
+  } catch {
+    const match = text.match(/\/v\/([A-Za-z0-9]+)/u);
+    return match?.[1] || "";
+  }
+}
+
+async function createShareTokenLink(slug, password, ttlHours) {
+  const linkArgs = ["share", "link", slug, "--password", password, "--json"];
+  if (ttlHours !== undefined) {
+    linkArgs.push("--ttl-hours", String(ttlHours));
+  }
+  return runViveworkerCliJson(linkArgs, 30_000);
+}
+
 function requiredString(value, name) {
   const text = optionalString(value);
   if (!text) throw rpcInvalidParams(`${name} is required`);
@@ -789,7 +877,7 @@ const TOOLS = [
   {
     name: "viveworker_share_file",
     title: "Share file",
-    description: "After phone approval, upload a workspace file to viveworker File Share and return the limited URL.",
+    description: "After phone approval, upload a workspace file to viveworker File Share and return the limited URL. If password is set, pass tokenize=true to also mint a short-lived passwordless ?t= URL.",
     inputSchema: {
       type: "object",
       additionalProperties: false,
@@ -798,11 +886,29 @@ const TOOLS = [
         workspaceRoot: { type: "string" },
         password: { type: "string" },
         expiresDays: { type: "string" },
+        tokenize: { type: "boolean" },
+        tokenTtlHours: { type: "number" },
         timeoutMs: { type: "number" },
       },
       required: ["path"],
     },
   },
+  {
+    name: "viveworker_share_link",
+    title: "Create File Share token URL",
+    description: "After phone approval, mint a short-lived passwordless ?t= URL for an existing password-protected File Share slug.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        slug: { type: "string" },
+        password: { type: "string" },
+        ttlHours: { type: "number" },
+        timeoutMs: { type: "number" },
+      },
+      required: ["slug", "password"],
+    },
+  },
   {
     name: "viveworker_thread_share",
     title: "Thread share",
@@ -871,7 +977,7 @@ const PROMPTS = [
       title: "Share deliverable",
       description: "Package a local deliverable through viveworker File Share with phone approval.",
     },
-    text: "When the user asks to share a report, prototype, screenshot, CSV, or standalone HTML deliverable, use viveworker_share_file. Only share files inside the workspace and never share secrets or credentials.",
+    text: "When the user asks to share a report, prototype, screenshot, CSV, or standalone HTML deliverable, use viveworker_share_file. Only share files inside the workspace and never share secrets or credentials. If the user wants a password-protected share but the recipient should not know the password, set password plus tokenize=true, or use viveworker_share_link for an existing password-protected slug to mint a short-lived ?t= URL.",
   },
   {
     definition: {

package/scripts/share-cli.mjs

@@ -719,7 +719,7 @@ async function handleUpdateWithFlags(flags, mode = "update") {
 // password-protected share to another agent without disclosing the password.
 //
 // The owner keeps the password on their side; the receiver only needs to GET
-// the returned URL. Tokens default to 24h, capped at 168h (7d) and capped by
+// the returned URL. Tokens default to 24h, capped at 720h (30d) and capped by
 // the share's own `expiresAtMs`. Rotating the password via `share update
 // --password ...` invalidates every outstanding token for the slug.
 // ---------------------------------------------------------------------------
@@ -748,8 +748,8 @@ async function handleLink(args) {
   if (hasTtl) {
     const raw = flags["ttl-hours"] || flags["ttlHours"];
     const n = Number(raw);
-    if (!Number.isFinite(n) || n <= 0 || n > 168) {
-      throw new Error("--ttl-hours must be a number between 1 and 168");
+    if (!Number.isFinite(n) || n <= 0 || n > 720) {
+      throw new Error("--ttl-hours must be a number between 1 and 720");
     }
     ttlHours = n;
   }
@@ -1269,7 +1269,7 @@ function formatApiError(op, status, body) {
     case "not-password-protected":
       return `${op} failed (${status}): share has no password — no link token needed, just share the URL directly`;
     case "invalid-ttlHours":
-      return `${op} failed (${status}): --ttl-hours must be between 1 and ${body.maxHours || 168}`;
+      return `${op} failed (${status}): --ttl-hours must be between 1 and ${body.maxHours || 720}`;
     // x402 / paid-share error codes — thrown by the worker on upload,
     // PATCH, or view. Keep the messages actionable; agents read these
     // back to the user verbatim.

package/scripts/viveworker.mjs

@@ -115,6 +115,9 @@ async function main(cliOptions) {
     case "stop":
       await runStop(cliOptions);
       return;
+    case "restart":
+      await runRestart(cliOptions);
+      return;
     case "status":
       await runStatus(cliOptions);
       return;
@@ -1181,6 +1184,11 @@ async function runStop(cliOptions) {
   ]);
 }
 
+async function runRestart(cliOptions) {
+  await runStop(cliOptions);
+  await runStart(cliOptions);
+}
+
 async function runStatus(cliOptions) {
   const configDir = resolvePath(cliOptions.configDir || defaultConfigDir);
   const envFile = resolvePath(cliOptions.envFile || path.join(configDir, "config.env"));
@@ -1834,6 +1842,7 @@ ${t(locale, "cli.help.commands")}
   ${t(locale, "cli.help.enable")}
   ${t(locale, "cli.help.start")}
   ${t(locale, "cli.help.stop")}
+  ${t(locale, "cli.help.restart")}
   ${t(locale, "cli.help.status")}
   ${t(locale, "cli.help.doctor")}
   ${t(locale, "cli.help.update")}

package/templates/CLAUDE.viveworker.md

@@ -26,7 +26,8 @@ Then restart the Claude Code session. If the tools are not available, ask the us
 - `viveworker_notify` sends an informational phone notification and records a timeline entry.
 - `viveworker_ask` asks the paired phone a question and waits for the answer.
 - `viveworker_request_approval` asks the phone to approve or reject a proposed action.
-- `viveworker_share_file` uploads a workspace file to File Share after phone approval.
+- `viveworker_share_file` uploads a workspace file to File Share after phone approval. For password-protected handoff, pass `tokenize: true` to return a short-lived passwordless `?t=` URL.
+- `viveworker_share_link` mints a short-lived passwordless `?t=` URL for an existing password-protected File Share slug after phone approval.
 - `viveworker_thread_share` shares context into another Codex / Claude / inbox thread.
 - `viveworker_send_a2a_task` sends a task to a registered A2A target after phone approval.
 
@@ -35,6 +36,7 @@ Then restart the Claude Code session. If the tools are not available, ask the us
 - If the user says "ask me on my phone", "スマホに聞いて", or a short decision blocks progress, use `viveworker_ask`.
 - If the user asks you to proceed with a risky, external, irreversible, payment-related, or user-visible action, use `viveworker_request_approval`.
 - If the user asks for a report, prototype, screenshot, PDF, CSV, or standalone HTML to become a shareable link, use `viveworker_share_file`.
+- If the user asks for a password-protected share but wants the recipient to open it without knowing the password, use `viveworker_share_file` with `password` and `tokenize: true`, or use `viveworker_share_link` for an existing slug.
 - If the user says "share this with Codex/Claude", "Aの内容をBに共有して", or wants context handed to another session, use `viveworker_thread_share`.
 - If the user wants another registered agent to do work, use `viveworker_send_a2a_task`.
 

package/web/i18n.js

@@ -885,13 +885,14 @@ const translations = {
     "server.page.choiceMissing": "Choice input token not found",
     "server.page.approvalHandled": "Approval already handled",
     "server.page.detailMissing": "Completion detail not found",
-    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|status|doctor|update> [options]",
+    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|restart|status|doctor|update> [options]",
     "cli.help.commands": "Commands:",
     "cli.help.setup": "setup         Create config, register launchd, and start the base viveworker bridge",
     "cli.help.pair": "pair          Refresh pairing info for another trusted device",
     "cli.help.enable": "enable        Enable an optional integration or feature",
     "cli.help.start": "start         Start the bridge using the saved config",
     "cli.help.stop": "stop          Stop the bridge",
+    "cli.help.restart": "restart       Restart the bridge using the saved config",
     "cli.help.status": "status        Print launchd/background status and health",
     "cli.help.doctor": "doctor        Diagnose the local setup",
     "cli.help.update": "update        Update to the latest version and restart all services",
@@ -1963,13 +1964,14 @@ const translations = {
     "server.page.choiceMissing": "選択入力トークンが見つかりません",
     "server.page.approvalHandled": "この承認はすでに処理済みです",
     "server.page.detailMissing": "完了詳細が見つかりません",
-    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|status|doctor|update> [options]",
+    "cli.help.usage": "Usage: viveworker <setup|pair|enable|start|stop|restart|status|doctor|update> [options]",
     "cli.help.commands": "Commands:",
     "cli.help.setup": "setup         base の設定を作成し、launchd に登録して viveworker bridge を起動します",
     "cli.help.pair": "pair          追加する信頼済み端末向けに pairing 情報を更新します",
     "cli.help.enable": "enable        オプション機能や連携を有効化します",
     "cli.help.start": "start         保存済み設定で bridge を起動します",
     "cli.help.stop": "stop          bridge を停止します",
+    "cli.help.restart": "restart       保存済み設定で bridge を再起動します",
     "cli.help.status": "status        launchd / バックグラウンド状態と health を表示します",
     "cli.help.doctor": "doctor        ローカル設定を診断します",
     "cli.help.update": "update        最新バージョンに更新し、全サービスを再起動します",