ProverCoderAI · skulidropek · Jun 19, 2026 · Jun 19, 2026 · Jun 20, 2026 · Jun 20, 2026
diff --git a/bun.lock b/bun.lock
diff --git a/packages/api/package.json b/packages/api/package.json
@@ -54,6 +54,6 @@
     "globals": "^17.6.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.61.1",
-    "vitest": "^4.1.9"
+    "vitest": "^3.2.0"
   }
 }
diff --git a/packages/api/src/api/contracts.ts b/packages/api/src/api/contracts.ts
@@ -809,3 +809,29 @@ export type ApiEvent = {
   readonly at: string
   readonly payload: unknown
 }
+
+export type ShareLinkInfo = {
+  readonly token: string
+  readonly projectKey: string
+  readonly projectDir: string
+  readonly displayName: string
+  readonly sshAlias: string
+  readonly sshConfigSnippet: string
+  readonly cfSshConfigSnippet: string | null
+  readonly vscodeUri: string
+  readonly cfVscodeUri: string | null
+  readonly workspacePath: string
+  readonly sshPassword: string | null
+  readonly createdAt: string
+  readonly expiresAt: string
+}
+
+export type CreateShareLinkRequest = {
+  readonly ttlMs?: number | undefined
+}
+
+export type CreateShareLinkResponse = {
+  readonly ok: true
+  readonly link: ShareLinkInfo
+  readonly url: string
+}
diff --git a/packages/api/src/api/openapi.ts b/packages/api/src/api/openapi.ts
@@ -30,6 +30,10 @@ import {
   ProjectDatabaseSessionSchema,
   ProjectPortForwardRequestSchema,
   ProjectSkillUpdateRequestSchema,
+  CreateShareLinkRequestSchema,
+  ShareLinkInfoResponseSchema,
+  CreateShareLinkResponseSchema,
+  ShareLinksListResponseSchema,
   StartPanelCloudflareTunnelRequestSchema,
   StartProjectTerminalSessionRequestSchema,
   UpProjectRequestSchema
@@ -735,6 +739,8 @@ const TasksGroup = HttpApiGroup.make("tasks")
       .addSuccess(OutputResponseSchema)
   )
 
+const ShareLinkTokenParam = HttpApiSchema.param("token", Schema.String)
+
 const SharingGroup = HttpApiGroup.make("sharing")
   .add(endpoint.get("readPanelCloudflareTunnel", "/cloudflare-tunnels/panel").addSuccess(PanelCloudflareTunnelResponseSchema))
   .add(
@@ -743,6 +749,14 @@ const SharingGroup = HttpApiGroup.make("sharing")
       .addSuccess(PanelCloudflareTunnelResponseSchema, { status: 202 })
   )
   .add(endpoint.del("stopPanelCloudflareTunnel", "/cloudflare-tunnels/panel").addSuccess(PanelCloudflareTunnelResponseSchema))
+  .add(endpoint.get("getShareLink")`/share-links/${ShareLinkTokenParam}`.addSuccess(ShareLinkInfoResponseSchema))
+  .add(
+    endpoint.post("createShareLink")`/projects/by-key/${ProjectKeyParam}/share-links`
+      .setPayload(CreateShareLinkRequestSchema)
+      .addSuccess(CreateShareLinkResponseSchema, { status: 201 })
+  )
+  .add(endpoint.get("listShareLinks")`/projects/by-key/${ProjectKeyParam}/share-links`.addSuccess(ShareLinksListResponseSchema))
+  .add(endpoint.del("deleteShareLink")`/projects/by-key/${ProjectKeyParam}/share-links/${ShareLinkTokenParam}`.addSuccess(OkResponseSchema))
 
 export const DockerGitApi = HttpApi.make("docker-git")
   .annotate(OpenApi.Title, "docker-git API")

diff --git a/packages/api/src/api/schema.ts b/packages/api/src/api/schema.ts
@@ -392,3 +392,37 @@ export type ProjectPortForwardRequestInput = Schema.Schema.Type<typeof ProjectPo
 export type ProjectDatabaseProfileRequestInput = Schema.Schema.Type<typeof ProjectDatabaseProfileRequestSchema>
 export type CreateAgentRequestInput = Schema.Schema.Type<typeof CreateAgentRequestSchema>
 export type CreateFollowRequestInput = Schema.Schema.Type<typeof CreateFollowRequestSchema>
+
+export const CreateShareLinkRequestSchema = Schema.Struct({
+  ttlMs: Schema.optional(Schema.Number)
+})
+
+export const ShareLinkInfoSchema = Schema.Struct({
+  token: Schema.String,
+  projectKey: Schema.String,
+  projectDir: Schema.String,
+  displayName: Schema.String,
+  sshAlias: Schema.String,
+  sshConfigSnippet: Schema.String,
+  cfSshConfigSnippet: Schema.NullOr(Schema.String),
+  vscodeUri: Schema.String,
+  cfVscodeUri: Schema.NullOr(Schema.String),
+  workspacePath: Schema.String,
+  sshPassword: Schema.NullOr(Schema.String),
+  createdAt: Schema.String,
+  expiresAt: Schema.String
+})
+
+export const ShareLinkInfoResponseSchema = Schema.Struct({
+  link: ShareLinkInfoSchema
+})
+
+export const CreateShareLinkResponseSchema = Schema.Struct({
+  ok: Schema.Literal(true),
+  link: ShareLinkInfoSchema,
+  url: Schema.String
+})
+
+export const ShareLinksListResponseSchema = Schema.Struct({
+  links: Schema.Array(ShareLinkInfoSchema)
+})
diff --git a/packages/api/src/http.ts b/packages/api/src/http.ts
@@ -38,6 +38,7 @@ import {
   ProjectPortForwardRequestSchema,
   ProjectPromptUpdateRequestSchema,
   ProjectSkillUpdateRequestSchema,
+  CreateShareLinkRequestSchema,
   StartProjectTerminalSessionRequestSchema,
   StartPanelCloudflareTunnelRequestSchema,
   StateCommitRequestSchema,
@@ -130,6 +131,24 @@ import {
   startPanelCloudflareTunnel,
   stopPanelCloudflareTunnel
 } from "./services/panel-cloudflare-tunnel.js"
+import {
+  createShareLink,
+  deleteShareLink,
+  listShareLinks,
+  resolveShareLink
+} from "./services/project-share-links.js"
+import {
+  getSshShareLinkTunnelHostname,
+  startSshShareLinkTunnel,
+  stopSshShareLinkTunnel
+} from "./services/ssh-share-link-tunnels.js"
+import { startSshProjectTunnel } from "./services/ssh-project-tunnels.js"
+import {
+  disableContainerPasswordAuth,
+  enableContainerPasswordAuth,
+  generateSshPassword
+} from "./services/ssh-password-setup.js"
+import { buildShareLinkSshAccess } from "@effect-template/lib/usecases/ssh-access"
 import {
   deleteProjectDatabaseForward,
   deleteProjectDatabaseProfile,
@@ -556,6 +575,13 @@ const skillScopeFromBody = (scope: string): ProjectSkillScope | null =>
 const readProjectPortForwardRequest = () => HttpServerRequest.schemaBodyJson(ProjectPortForwardRequestSchema)
 const readStartPanelCloudflareTunnelRequest = () =>
   HttpServerRequest.schemaBodyJson(StartPanelCloudflareTunnelRequestSchema)
+const readCreateShareLinkRequest = () =>
+  HttpServerRequest.schemaBodyJson(CreateShareLinkRequestSchema)
+
+const ShareLinkTokenParamsSchema = Schema.Struct({ token: Schema.String })
+const ShareLinkByProjectKeyParamsSchema = Schema.Struct({ projectKey: Schema.String, token: Schema.String })
+const shareLinkTokenParams = HttpRouter.schemaParams(ShareLinkTokenParamsSchema)
+const shareLinkByProjectKeyParams = HttpRouter.schemaParams(ShareLinkByProjectKeyParamsSchema)
 const readProjectDatabaseProfileRequest = () => HttpServerRequest.schemaBodyJson(ProjectDatabaseProfileRequestSchema)
 const readStateInitRequest = () => HttpServerRequest.schemaBodyJson(StateInitRequestSchema)
 const readStateCommitRequest = () => HttpServerRequest.schemaBodyJson(StateCommitRequestSchema)
@@ -1104,6 +1130,144 @@ export const makeRouter = () => {
         Effect.flatMap((tunnel) => jsonResponse({ tunnel }, 200)),
         Effect.catchAll(errorResponse)
       )
+    ),
+    HttpRouter.get(
+      "/share-links/:token",
+      Effect.gen(function*(_) {
+        const request = yield* _(HttpServerRequest.HttpServerRequest)
+        const { token } = yield* _(shareLinkTokenParams)
+        const projectsRoot = defaultProjectsRoot(process.cwd())
+        const link = yield* _(resolveShareLink(projectsRoot, token))
+        if (link === null) {
+          return yield* _(Effect.fail(new ApiNotFoundError({ message: `Share link not found or expired: ${token}` })))
+        }
+        const project = yield* _(getProjectItemByKey(link.projectKey))
+        const clientHost = new URL(request.url, "http://localhost").searchParams.get("host")
+          ?? resolvePortPublicHost(request)
+          ?? "localhost"
+        const sshCfHostname = getSshShareLinkTunnelHostname(link.token)
+        const sshAccess = buildShareLinkSshAccess({
+          containerName: project.containerName,
+          sshUser: project.sshUser,
+          sshPort: project.sshPort,
+          sshKeyPath: null,
+          targetDir: project.targetDir,
+          clientHost,
+          sshCfHostname
+        })
+        const shareLinkInfo = {
+          token: link.token,
+          projectKey: link.projectKey,
+          projectDir: link.projectDir,
+          displayName: project.displayName,
+          sshAlias: sshAccess.alias,
+          sshConfigSnippet: sshAccess.configSnippet,
+          cfSshConfigSnippet: sshAccess.cfConfigSnippet,
+          vscodeUri: sshAccess.vscodeUri,
+          cfVscodeUri: sshAccess.cfVscodeUri,
+          workspacePath: sshAccess.workspacePath,
+          sshPassword: link.sshPassword ?? null,
+          createdAt: link.createdAt,
+          expiresAt: link.expiresAt
+        }
+        return yield* _(jsonResponse({ link: shareLinkInfo }, 200))
+      }).pipe(Effect.catchAll(errorResponse))
+    ),
+    HttpRouter.post(
+      "/projects/by-key/:projectKey/share-links",
+      Effect.gen(function*(_) {
+        const request = yield* _(HttpServerRequest.HttpServerRequest)
+        const { projectKey } = yield* _(projectKeyParams)
+        const body = yield* _(readCreateShareLinkRequest())
+        const project = yield* _(getProjectItemByKey(projectKey))
+        const projectsRoot = defaultProjectsRoot(process.cwd())
+        const sshPassword = generateSshPassword()
+        yield* _(
+          enableContainerPasswordAuth(project.containerName, sshPassword).pipe(
+            Effect.orElse(() => Effect.void)
+          )
+        )
+        const link = yield* _(createShareLink(projectsRoot, project.projectDir, projectKey, sshPassword, body.ttlMs))
+        const clientHost = resolvePortPublicHost(request) ?? "localhost"
+        const sshCfHostname = yield* _(
+          startSshShareLinkTunnel(link.token, project.sshPort).pipe(
+            Effect.orElse(() => Effect.succeed(null))
+          )
+        )
+        const sshAccess = buildShareLinkSshAccess({
+          containerName: project.containerName,
+          sshUser: project.sshUser,
+          sshPort: project.sshPort,
+          sshKeyPath: null,
+          targetDir: project.targetDir,
+          clientHost,
+          sshCfHostname
+        })
+        const shareLinkInfo = {
+          token: link.token,
+          projectKey: link.projectKey,
+          projectDir: link.projectDir,
+          displayName: project.displayName,
+          sshAlias: sshAccess.alias,
+          sshConfigSnippet: sshAccess.configSnippet,
+          cfSshConfigSnippet: sshAccess.cfConfigSnippet,
+          vscodeUri: sshAccess.vscodeUri,
+          cfVscodeUri: sshAccess.cfVscodeUri,
+          workspacePath: sshAccess.workspacePath,
+          sshPassword,
+          createdAt: link.createdAt,
+          expiresAt: link.expiresAt
+        }
+        const url = `${resolveRequestOrigin(request)}/ssh/${encodeURIComponent(projectKey)}?t=${link.token}`
+        return yield* _(jsonResponse({ ok: true, link: shareLinkInfo, url }, 201))
+      }).pipe(Effect.catchAll(errorResponse))
+    ),
+    HttpRouter.get(
+      "/projects/by-key/:projectKey/share-links",
+      projectKeyParams.pipe(
+        Effect.flatMap(({ projectKey }) =>
+          Effect.gen(function*(_) {
+            const project = yield* _(getProjectItemByKey(projectKey))
+            const projectsRoot = defaultProjectsRoot(process.cwd())
+            const links = yield* _(listShareLinks(projectsRoot, project.projectDir))
+            return { links }
+          })
+        ),
+        Effect.flatMap((payload) => jsonResponse(payload, 200)),
+        Effect.catchAll(errorResponse)
+      )
+    ),
+    HttpRouter.del(
+      "/projects/by-key/:projectKey/share-links/:token",
+      shareLinkByProjectKeyParams.pipe(
+        Effect.flatMap(({ projectKey, token }) =>
+          Effect.gen(function*(_) {
+            const project = yield* _(getProjectItemByKey(projectKey))
+            const projectsRoot = defaultProjectsRoot(process.cwd())
+            yield* _(deleteShareLink(projectsRoot, project.projectDir, token))
+            yield* _(stopSshShareLinkTunnel(token))
+            const remaining = yield* _(listShareLinks(projectsRoot, project.projectDir))
+            if (remaining.length === 0) {
+              yield* _(disableContainerPasswordAuth(project.containerName))
+            }
+          })
+        ),
+        Effect.flatMap(() => jsonResponse({ ok: true }, 200)),
+        Effect.catchAll(errorResponse)
+      )
+    ),
+    HttpRouter.post(
+      "/projects/by-key/:projectKey/ssh-tunnel",
+      Effect.gen(function*(_) {
+        const { projectKey } = yield* _(projectKeyParams)
+        const project = yield* _(getProjectItemByKey(projectKey))
+        const result = yield* _(
+          startSshProjectTunnel(projectKey, project.sshPort, project.containerName).pipe(
+            Effect.orElse(() => Effect.succeed({ hostname: null, sshPassword: "" }))
+          )
+        )
+        return yield* _(jsonResponse(result, 200))
+      }).pipe(Effect.catchAll(errorResponse))
     )
   )