From c0912fcd41e9f701c3b2e4d2bf1c01f5d4b3337d Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:20:27 -0500
Subject: [PATCH 01/11] Serve a share link's revisions to the canvas

Agent-Session: 64182dea-534e-45f1-8e28-c1e27a5d6bab
Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/src/sharing/host.ts         | 107 +++++++++++------
 packages/review/src/sharing/publish.test.ts | 121 ++++++++++++++++++++
 2 files changed, 191 insertions(+), 37 deletions(-)

diff --git a/packages/review/src/sharing/host.ts b/packages/review/src/sharing/host.ts
index 48eec35377..27364fafc2 100644
--- a/packages/review/src/sharing/host.ts
+++ b/packages/review/src/sharing/host.ts
@@ -401,6 +401,40 @@ export function remoteShare(
       : undefined;
 }
 
+const appUrl = (href: string) => {
+  const url = new URL(href);
+
+  if (
+    process.env.DEV_FAST_REVIEW_APP_URL_PROTOCOL === "dev-fast-review-preview"
+  )
+    url.searchParams.set("app", "preview");
+
+  return url.href;
+};
+
+const shareRequest = async <T>(
+  request: () => Promise<T>,
+  message: string,
+): Promise<T> => {
+  try {
+    return await request();
+  } catch (error) {
+    if (error instanceof ReviewInputError) throw error;
+
+    if (error instanceof ShareAuthError) {
+      // A CI token lives in the environment; only the saved login can go stale.
+      if (process.env.DEV_REVIEW_SHARE_TOKEN === undefined)
+        await clearStoreAuth();
+      throw new ReviewInputError(
+        "Your sign-in has expired. Sign in again to share.",
+        401,
+      );
+    }
+
+    throw new ReviewInputError(message, 409);
+  }
+};
+
 /** Publishing needs only an authored store, never Desktop or recipient workspaces. */
 export function mountSharingPublisher(
   app: Hono,
@@ -498,49 +532,48 @@ export function mountSharingPublisher(
 
     const { bundle, version } = await prepare(input);
 
-    try {
-      const result = await new ShareClient(
-        account.origin,
-        account.token,
-        options.fetch,
-      ).create(bundle, input.requestId ?? randomUUID());
-
-      const url = new URL(result.url);
-
-      if (
-        process.env.DEV_FAST_REVIEW_APP_URL_PROTOCOL ===
-        "dev-fast-review-preview"
-      )
-        url.searchParams.set("app", "preview");
-
-      options.onPublished?.({
-        reviewId: input.reviewId,
-        version,
-      });
+    const result = await shareRequest(
+      () =>
+        new ShareClient(account.origin, account.token, options.fetch).create(
+          bundle,
+          input.requestId ?? randomUUID(),
+        ),
+      "Sharing failed. Check your connection and login, then retry.",
+    );
 
-      return context.json({
-        ...result,
-        url: url.href,
-        version,
-      });
-    } catch (error) {
-      if (error instanceof ReviewInputError) throw error;
+    options.onPublished?.({
+      reviewId: input.reviewId,
+      version,
+    });
 
-      if (error instanceof ShareAuthError) {
-        // A CI token lives in the environment; only the saved login can go stale.
-        if (process.env.DEV_REVIEW_SHARE_TOKEN === undefined)
-          await clearStoreAuth();
-        throw new ReviewInputError(
-          "Your sign-in has expired. Sign in again to share.",
-          401,
-        );
-      }
+    return context.json({
+      ...result,
+      url: appUrl(result.url),
+      version,
+    });
+  });
+  app.get("/sharing/history/:shareId", async (context) => {
+    const shareId = shareIdSchema.parse(context.req.param("shareId"));
+    const account = await readSharingAuth();
 
+    if (!account)
       throw new ReviewInputError(
-        "Sharing failed. Check your connection and login, then retry.",
+        "Set DEV_REVIEW_SHARE_TOKEN for CI, or run whiteboard login first.",
         409,
       );
-    }
+
+    const history = await shareRequest(
+      () =>
+        new ShareClient(account.origin, account.token, options.fetch).revisions(
+          shareId,
+        ),
+      "Could not load this link's history. Check your connection, then retry.",
+    );
+
+    return context.json({
+      ...history,
+      items: history.items.map((item) => ({ ...item, url: appUrl(item.url) })),
+    });
   });
   app.post("/sharing/revoke", async (context) => {
     const { shareId } = z
diff --git a/packages/review/src/sharing/publish.test.ts b/packages/review/src/sharing/publish.test.ts
index 4b755b3bcb..3de80a947b 100644
--- a/packages/review/src/sharing/publish.test.ts
+++ b/packages/review/src/sharing/publish.test.ts
@@ -125,3 +125,124 @@ it("signs the user out when the share service rejects the stored token", async (
     await rm(root, { recursive: true, force: true });
   }
 });
+
+const historyHost = async (
+  root: string,
+  fetch: typeof globalThis.fetch,
+  token = "fixture",
+) => {
+  const fixture = await createShareFixture(root);
+  await writeStoreAuth({
+    origin: "https://app.dev.fast",
+    token,
+    login: "fixture",
+    savedAt: new Date().toISOString(),
+  });
+  const api = new Hono();
+  api.onError((error, context) =>
+    context.json(
+      { error: error.message },
+      error instanceof ReviewInputError ? error.status : 500,
+    ),
+  );
+  mountSharingHost(api, fixture.store, fixture.data, { fetch });
+
+  return { api, fixture };
+};
+
+it.each(["dev-fast-review", "dev-fast-review-preview"])(
+  "lists a link's revisions newest first (%s)",
+  async (protocol) => {
+    const root = await mkdtemp(path.join(tmpdir(), "sharing-history-"));
+    vi.stubEnv("DEV_REVIEW_HOME", root);
+    vi.stubEnv("DEV_FAST_REVIEW_APP_URL_PROTOCOL", protocol);
+    const preview = protocol === "dev-fast-review-preview";
+    const [shareId, R1, R2] = [randomUUID(), randomUUID(), randomUUID()];
+    const link = `https://app.dev.fast/s/${"x".repeat(43)}`;
+    const requests: string[] = [];
+
+    const { api, fixture } = await historyHost(root, async (input, init) => {
+      const url = new URL(String(input));
+
+      if (url.pathname === "/api/auth/token")
+        return new Response(null, { status: 404 });
+      requests.push(`${init?.method ?? "GET"} ${url.pathname}`);
+
+      return Response.json({
+        latest: R2,
+        items: [
+          {
+            id: R2,
+            version: 5,
+            size: 2048,
+            createdAt: 2,
+            url: `${link}?rev=${R2}`,
+          },
+          {
+            id: R1,
+            version: 4,
+            size: 1024,
+            createdAt: 1,
+            url: `${link}?rev=${R1}`,
+          },
+        ],
+      });
+    });
+
+    try {
+      expect(
+        await (await api.request(`/sharing/history/${shareId}`)).json(),
+      ).toEqual({
+        latest: R2,
+        items: [
+          {
+            id: R2,
+            version: 5,
+            size: 2048,
+            createdAt: 2,
+            url: `${link}?rev=${R2}${preview ? "&app=preview" : ""}`,
+          },
+          {
+            id: R1,
+            version: 4,
+            size: 1024,
+            createdAt: 1,
+            url: `${link}?rev=${R1}${preview ? "&app=preview" : ""}`,
+          },
+        ],
+      });
+      expect(requests).toEqual([`GET /api/v2/shares/${shareId}/revisions`]);
+    } finally {
+      vi.unstubAllEnvs();
+      await fixture.data.close();
+      await fixture.store.close();
+      await rm(root, { recursive: true, force: true });
+    }
+  },
+);
+
+it("signs the user out when loading a link's history is unauthorized", async () => {
+  const root = await mkdtemp(path.join(tmpdir(), "sharing-history-"));
+  vi.stubEnv("DEV_REVIEW_HOME", root);
+
+  const { api, fixture } = await historyHost(
+    root,
+    async () => new Response("unauthorized", { status: 401 }),
+    "expired",
+  );
+
+  try {
+    const response = await api.request(`/sharing/history/${randomUUID()}`);
+
+    expect(await response.json()).toEqual({
+      error: "Your sign-in has expired. Sign in again to share.",
+    });
+    expect(response.status).toBe(401);
+    expect(await readStoreAuth()).toBeNull();
+  } finally {
+    vi.unstubAllEnvs();
+    await fixture.data.close();
+    await fixture.store.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});

From f49c9832a087a0426b07c8d0a034b77c52463f9a Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:21:08 -0500
Subject: [PATCH 02/11] Open a share revision in the browser through the host

Agent-Session: 64182dea-534e-45f1-8e28-c1e27a5d6bab
Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/src/sharing/host.test.ts | 41 ++++++++++++++++++++++++
 packages/review/src/sharing/host.ts      | 24 +++++++++++++-
 2 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/packages/review/src/sharing/host.test.ts b/packages/review/src/sharing/host.test.ts
index a4a20ad3c5..d962a1936d 100644
--- a/packages/review/src/sharing/host.test.ts
+++ b/packages/review/src/sharing/host.test.ts
@@ -9,6 +9,7 @@ import {
   type runStoreLogin,
   writeStoreAuth,
 } from "@dev.fast/trace-core";
+import { ReviewInputError } from "@dev.fast/whiteboard-document";
 import type { SharedProvenance } from "@review/review-api/store.js";
 import { Hono } from "hono";
 import { afterEach, expect, it, vi } from "vitest";
@@ -481,3 +482,43 @@ it("reports the saved sign-in and forgets it on sign-out", async () => {
     await rm(root, { recursive: true, force: true });
   }
 });
+
+it("opens a share revision in the browser and refuses any other URL", async () => {
+  const root = await mkdtemp(path.join(tmpdir(), "share-open-"));
+  vi.stubEnv("DEV_REVIEW_HOME", root);
+  const fixture = await createShareFixture(root);
+  const api = new Hono();
+  const openUrl = vi.fn<typeof openUrlInBrowser>(async () => {});
+  api.onError((error, context) =>
+    context.json(
+      { error: error.message },
+      error instanceof ReviewInputError ? error.status : 500,
+    ),
+  );
+  mountSharingHost(api, fixture.store, fixture.data, { openUrl });
+
+  const post = (path: string, body: { url: string }) =>
+    api.request(path, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    });
+
+  try {
+    expect(
+      (await post("/sharing/open", { url: `${url}?rev=${R}` })).status,
+    ).toBe(200);
+    expect(openUrl).toHaveBeenCalledWith(`${url}?rev=${R}`);
+
+    for (const url of [
+      "https://evil.test/s/" + capability,
+      "file:///etc/passwd",
+    ])
+      expect((await post("/sharing/open", { url })).status).toBe(400);
+    expect(openUrl).toHaveBeenCalledTimes(1);
+  } finally {
+    await fixture.data.close();
+    fixture.store.close();
+    await rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/packages/review/src/sharing/host.ts b/packages/review/src/sharing/host.ts
index 27364fafc2..29dc26ad5d 100644
--- a/packages/review/src/sharing/host.ts
+++ b/packages/review/src/sharing/host.ts
@@ -12,7 +12,7 @@ import {
 import {
   DEFAULT_STORE_ORIGIN,
   clearStoreAuth,
-  type openUrlInBrowser,
+  openUrlInBrowser,
   readStoreAuth,
   runStoreLogin,
 } from "@dev.fast/trace-core";
@@ -181,6 +181,28 @@ export function mountSharingHost(
 
     return context.json(login);
   });
+  app.post("/sharing/open", async (context) => {
+    const { url } = z
+      .strictObject({ url: z.string().max(2048) })
+      .parse(await readBoundedRequestJson(context.req.raw));
+
+    const origin = (() => {
+      try {
+        return parseShareLink(url).origin;
+      } catch {
+        return undefined;
+      }
+    })();
+
+    if (
+      origin !== DEFAULT_STORE_ORIGIN &&
+      (!origin || origin !== (await readStoreAuth())?.origin)
+    )
+      throw new ReviewInputError("Only Whiteboard share links open here.", 400);
+    await (options.openUrl ?? openUrlInBrowser)(url);
+
+    return context.json({ opened: true });
+  });
   mountSharingPublisher(app, store, data, options);
 
   const imports = new Map<string, ImportStatus>();

From ae15f2f6b81ae39a1532e0df50d0b9936011a9e3 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:21:26 -0500
Subject: [PATCH 03/11] Let the canvas ask the host to confirm

Agent-Session: 64182dea-534e-45f1-8e28-c1e27a5d6bab
Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 .../src/vs/review/browser/parts/canvas/reviewCanvasPart.ts   | 2 ++
 packages/review-protocol/src/contracts.ts                    | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/apps/review-desktop/code-oss/src/vs/review/browser/parts/canvas/reviewCanvasPart.ts b/apps/review-desktop/code-oss/src/vs/review/browser/parts/canvas/reviewCanvasPart.ts
index 3f014a568b..e9b793e459 100644
--- a/apps/review-desktop/code-oss/src/vs/review/browser/parts/canvas/reviewCanvasPart.ts
+++ b/apps/review-desktop/code-oss/src/vs/review/browser/parts/canvas/reviewCanvasPart.ts
@@ -1450,6 +1450,7 @@ export class ReviewCanvasEditorPane extends EditorPane {
 		| "onDidChangeDiffLayout"
 		| "setupTooltip"
 		| "notify"
+		| "confirm"
 		| "ready"
 		| "reportDiagnostic"
 		| "reportSidebar"
@@ -1472,6 +1473,7 @@ export class ReviewCanvasEditorPane extends EditorPane {
 			setDiffLayout: (scope, layout) => this.diffViews.layout(scope).set(layout),
 			onDidChangeDiffLayout: (scope, listener) => this.diffViews.layout(scope).onDidChange(listener),
 			notify: (notification) => showReviewNotification(this.notificationService, notification),
+			confirm: async (request) => (await this.dialogService.confirm({ type: 'warning', ...request })).confirmed,
 			setupTooltip: this.setupTooltip,
 			ready: () => {
 				if (generation !== this.loadGeneration || !this.targetDocument) return;
diff --git a/packages/review-protocol/src/contracts.ts b/packages/review-protocol/src/contracts.ts
index 2c75e63a5b..00488b5b97 100644
--- a/packages/review-protocol/src/contracts.ts
+++ b/packages/review-protocol/src/contracts.ts
@@ -404,6 +404,11 @@ export interface ReviewCanvasBridge {
     listener: (show: boolean) => void,
   ): ReviewDisposable;
   notify?(notification: ReviewNotification): ReviewDisposable;
+  confirm?(request: {
+    message: string;
+    detail?: string;
+    primaryButton: string;
+  }): Promise<boolean>;
   setupTooltip?(
     target: HTMLElement,
     text: string,

From 3ee209782a162b467cbaa2f4d7f5f4e48de09784 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:22:45 -0500
Subject: [PATCH 04/11] Format byte sizes

Agent-Session: 64182dea-534e-45f1-8e28-c1e27a5d6bab
Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/app/src/format.test.ts |  8 +++++++-
 packages/review/app/src/format.ts      | 10 ++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/packages/review/app/src/format.test.ts b/packages/review/app/src/format.test.ts
index ed42d88280..0e2fd52237 100644
--- a/packages/review/app/src/format.test.ts
+++ b/packages/review/app/src/format.test.ts
@@ -1,6 +1,6 @@
 import { expect, it } from "vitest";
 
-import { formatRelativeTime } from "./format";
+import { formatBytes, formatRelativeTime } from "./format";
 
 const now = Date.parse("2026-10-15T12:00:00Z");
 
@@ -27,3 +27,9 @@ it("writes hours and days in short for a narrow row", () => {
     "2d ago",
   );
 });
+
+it("writes a size in B, KB or MB", () => {
+  expect(formatBytes(512)).toBe("512 B");
+  expect(formatBytes(2048)).toBe("2 KB");
+  expect(formatBytes(1_572_864)).toBe("1.5 MB");
+});
diff --git a/packages/review/app/src/format.ts b/packages/review/app/src/format.ts
index 4046d1432c..a63e4636cd 100644
--- a/packages/review/app/src/format.ts
+++ b/packages/review/app/src/format.ts
@@ -65,3 +65,13 @@ export function formatDuration(durationMs: number): string {
 
   return rest ? `${hours}h ${rest}m` : `${hours}h`;
 }
+
+/** A byte count to one decimal: "512 B", "2 KB", "1.5 MB". */
+export function formatBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  const kilobytes = bytes / 1024;
+
+  if (kilobytes < 1024) return `${Number(kilobytes.toFixed(1))} KB`;
+
+  return `${Number((kilobytes / 1024).toFixed(1))} MB`;
+}

From 0bcb36ff3bc02156a06f5a5c88384cfda87fcca4 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:28:41 -0500
Subject: [PATCH 05/11] List a share link's revisions in the share popover

Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/app/src/canvas-query.tsx      |  1 +
 .../review/app/src/share-control.test.tsx     | 54 ++++++++++++++-
 packages/review/app/src/share-control.tsx     | 69 +++++++++++++++++--
 3 files changed, 119 insertions(+), 5 deletions(-)

diff --git a/packages/review/app/src/canvas-query.tsx b/packages/review/app/src/canvas-query.tsx
index 88b6aeda1d..172964a353 100644
--- a/packages/review/app/src/canvas-query.tsx
+++ b/packages/review/app/src/canvas-query.tsx
@@ -35,6 +35,7 @@ export function createCanvasQueryClient(): QueryClient {
 export const canvasQueryKeys = {
   sharingAccount: () => ["sharing", "account"] as const,
   shareLink: (board: string) => ["sharing", "link", board] as const,
+  shareHistory: (shareId: string) => ["sharing", "history", shareId] as const,
   traceList: (
     board: string,
     version: number | undefined,
diff --git a/packages/review/app/src/share-control.test.tsx b/packages/review/app/src/share-control.test.tsx
index b285cc6c3a..120ade31c6 100644
--- a/packages/review/app/src/share-control.test.tsx
+++ b/packages/review/app/src/share-control.test.tsx
@@ -11,6 +11,16 @@ import { ShareControl, SharingContext } from "./share-control";
 
 let dispose: (() => void) | undefined;
 
+const shareId = "6f1c2b0e-8e0a-4b8e-9a51-0d6f1e2c3b4a";
+
+const revision5 = "0b8d6c3e-3a9f-4c1e-8f2a-5d7e9b1c4a60";
+
+const revision4 = "1c9e7d4f-4b0a-4d2f-9a3b-6e8f0c2d5b71";
+
+const u5 = `https://app.dev.fast/s/capability?rev=${revision5}`;
+
+const u4 = `https://app.dev.fast/s/capability?rev=${revision4}`;
+
 afterEach(async () => {
   await act(async () => dispose?.());
   document.body.replaceChildren();
@@ -75,6 +85,29 @@ function mount(options: {
         });
       }
 
+      if (path.includes("/history/"))
+        return Response.json({
+          latest: revision5,
+          items: [
+            {
+              id: revision5,
+              version: 5,
+              size: 2048,
+              createdAt: Date.now(),
+              url: u5,
+            },
+            {
+              id: revision4,
+              version: 4,
+              size: 1024,
+              createdAt: Date.now() - 2 * 3_600_000,
+              url: u4,
+            },
+          ],
+        });
+
+      if (path.endsWith("/open")) return Response.json({ opened: true });
+
       if (state.holdPublish) await state.holdPublish;
 
       if (
@@ -101,7 +134,7 @@ function mount(options: {
         );
 
       return Response.json({
-        shareId: "6f1c2b0e-8e0a-4b8e-9a51-0d6f1e2c3b4a",
+        shareId,
         url: "https://app.dev.fast/s/capability",
         version: JSON.parse(String(init!.body)).version,
       });
@@ -410,6 +443,25 @@ it("shows a newer version's link when the popover opens on an older version", as
   expect(container.querySelector("input")?.value).toContain("/s/capability");
 });
 
+it("lists the link's revisions newest first, marks the latest and opens one in the browser", async () => {
+  const harness = mount({ signedIn: true });
+  const { container } = harness;
+
+  await harness.render(5);
+  await harness.click("Share review");
+  await harness.settle();
+  expect(
+    [...container.querySelectorAll("[role=dialog] [data-share-revision]")].map(
+      (row) => row.textContent,
+    ),
+  ).toEqual(["just now · v5 · 2 KB · Latest", "2 hours ago · v4 · 1 KB"]);
+  await harness.click("2 hours ago · v4 · 1 KB");
+  expect(harness.posts.at(-1)).toEqual({
+    path: "/reviews-api/sharing/open",
+    body: { url: u4 },
+  });
+});
+
 it("polls only while sign-in is pending and stops when the control unmounts", async () => {
   vi.useFakeTimers({
     toFake: ["setTimeout", "clearTimeout", "setInterval", "clearInterval"],
diff --git a/packages/review/app/src/share-control.tsx b/packages/review/app/src/share-control.tsx
index dbf6b150e8..d0fbf626fa 100644
--- a/packages/review/app/src/share-control.tsx
+++ b/packages/review/app/src/share-control.tsx
@@ -1,12 +1,15 @@
 import { layer, space } from "@canvas/scale.stylex";
-import { Button, IconButton } from "@canvas/ui/button";
+import { Button, IconButton, buttonStyles } from "@canvas/ui/button";
 import { useCopy } from "@canvas/ui/copy";
+import { focusStyles } from "@canvas/ui/focus";
 import { iconStyles } from "@canvas/ui/icon-styles";
 import { ShareIcon } from "@canvas/ui/icons";
+import { listRowStyles } from "@canvas/ui/list-row";
 import { Popover } from "@canvas/ui/popover";
 import { textStyles } from "@canvas/ui/text";
 import { TextField } from "@canvas/ui/text-field";
 import { useTooltip } from "@canvas/ui/tooltip";
+import type { ShareRevisions } from "@dev.fast/review-share-protocol";
 import {
   type ReviewApiClient,
   ReviewApiError,
@@ -29,6 +32,7 @@ import {
 } from "react";
 
 import { canvasQueryKeys } from "./canvas-query";
+import { formatBytes, formatRelativeTime } from "./format";
 import { useOptionalReviewSession } from "./host/review-session";
 import { topbarActionsMarker } from "./markers.stylex";
 import { useSharingAccount, useSignIn } from "./sharing-account";
@@ -119,10 +123,14 @@ export function ShareControl({
         requestId,
       }),
     // An older version's upload can land after a newer one's.
-    onSuccess: (shared) =>
+    onSuccess: (shared) => {
       queryClient.setQueryData<SharedLink>(linkKey, (cached) =>
         cached && cached.version > shared.version ? cached : shared,
-      ),
+      );
+      void queryClient.invalidateQueries({
+        queryKey: canvasQueryKeys.shareHistory(shared.shareId),
+      });
+    },
     onError: (error) => {
       // The host forgot a stale login; show sign-in and upload again after it.
       if (error instanceof ReviewApiError && error.status === 401)
@@ -130,6 +138,11 @@ export function ShareControl({
     },
   });
 
+  const openRevision = useMutation({
+    mutationFn: (url: string) =>
+      context!.client.post<{ opened: true }>("/sharing/open", { url }),
+  });
+
   const upload = (next: ShareTarget) => {
     login.reset();
     publish.mutate(next);
@@ -146,6 +159,7 @@ export function ShareControl({
       });
       publish.reset();
       login.reset();
+      openRevision.reset();
       setCopyError(undefined);
     }
 
@@ -164,6 +178,20 @@ export function ShareControl({
   const current =
     link && target && link.version >= target.version ? link : undefined;
 
+  const historyQuery = useQuery({
+    queryKey: canvasQueryKeys.shareHistory(current?.shareId ?? ""),
+    queryFn:
+      open && current
+        ? ({ signal }) =>
+            context!.client.read<ShareRevisions>(
+              `/sharing/history/${current.shareId}`,
+              signal,
+            )
+        : skipToken,
+  });
+
+  const history = historyQuery.data;
+
   // Upload once per opening; a failure waits for Retry or a new sign-in.
   useEffect(() => {
     if (open && signedIn && target && publish.isIdle && !current)
@@ -172,7 +200,11 @@ export function ShareControl({
 
   if (!context) return null;
 
-  const error = copyError ?? actionError(publish.error ?? login.error);
+  const error =
+    copyError ??
+    actionError(
+      publish.error ?? login.error ?? openRevision.error ?? historyQuery.error,
+    );
 
   const accountError = accountQuery.isError
     ? "Could not read sign-in status."
@@ -233,6 +265,30 @@ export function ShareControl({
                 <Button variant="primary" onClick={() => copy(current.url)}>
                   {copied === current.url ? "Copied" : "Copy link"}
                 </Button>
+                {history && history.items.length > 0 && (
+                  <ul
+                    aria-label="Share history"
+                    {...stylex.props(styles.history)}
+                  >
+                    {history.items.map((revision) => (
+                      <li key={revision.id}>
+                        <button
+                          type="button"
+                          data-share-revision=""
+                          {...stylex.props(
+                            focusStyles.ringInset,
+                            buttonStyles.reset,
+                            listRowStyles.row,
+                            listRowStyles.wash,
+                          )}
+                          onClick={() => openRevision.mutate(revision.url)}
+                        >
+                          {`${formatRelativeTime(revision.createdAt)} · v${revision.version} · ${formatBytes(revision.size)}${revision.id === history.latest ? " · Latest" : ""}`}
+                        </button>
+                      </li>
+                    ))}
+                  </ul>
+                )}
               </>
             ) : error ? (
               <Button
@@ -323,6 +379,11 @@ const styles = stylex.create({
   link: {
     width: "100%",
   },
+  history: {
+    margin: 0,
+    padding: 0,
+    listStyle: "none",
+  },
   code: {
     color: tokens.chromeFg,
     fontFamily: tokens.fontMono,

From 646fcda9da64f2faa816aefd14320b9386ef0bce Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:33:08 -0500
Subject: [PATCH 06/11] Revoke a share link from the share popover

Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 .../review/app/src/share-control.test.tsx     | 38 +++++++++++
 packages/review/app/src/share-control.tsx     | 68 +++++++++++++++++--
 2 files changed, 102 insertions(+), 4 deletions(-)

diff --git a/packages/review/app/src/share-control.test.tsx b/packages/review/app/src/share-control.test.tsx
index 120ade31c6..0811792bf5 100644
--- a/packages/review/app/src/share-control.test.tsx
+++ b/packages/review/app/src/share-control.test.tsx
@@ -38,6 +38,7 @@ function mount(options: {
   holdPublish?: Promise<void>;
   holdVersion?: { version: number; until: Promise<void> };
   sender?: string;
+  confirm?: () => Promise<boolean>;
 }) {
   vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
   const state = { ...options };
@@ -54,6 +55,7 @@ function mount(options: {
 
         return Response.json({ ok: true });
       },
+      confirm: options.confirm,
     },
   );
 
@@ -108,6 +110,9 @@ function mount(options: {
 
       if (path.endsWith("/open")) return Response.json({ opened: true });
 
+      if (path.endsWith("/revoke"))
+        return Response.json({ shareId, revoked: true });
+
       if (state.holdPublish) await state.holdPublish;
 
       if (
@@ -460,6 +465,39 @@ it("lists the link's revisions newest first, marks the latest and opens one in t
     path: "/reviews-api/sharing/open",
     body: { url: u4 },
   });
+  expect(container.textContent).not.toContain("Revoke link");
+});
+
+it("revokes the link after the host confirms, and the next opening shares a new one", async () => {
+  let answer = false;
+  const confirm = vi.fn<() => Promise<boolean>>(async () => answer);
+  const harness = mount({ signedIn: true, confirm });
+  const { container } = harness;
+
+  const posts = (suffix: string) =>
+    harness.posts.filter((post) => post.path.endsWith(suffix));
+
+  await harness.render(5);
+  await harness.click("Share review");
+  await harness.settle();
+  await harness.click("Revoke link");
+  expect(confirm).toHaveBeenCalledTimes(1);
+  expect(posts("/revoke")).toHaveLength(0);
+  answer = true;
+  await harness.click("Revoke link");
+  await harness.settle();
+  expect(posts("/revoke").map((post) => post.body)).toEqual([{ shareId }]);
+  expect(container.textContent).toContain(
+    "Link revoked. Sharing this board again creates a new link.",
+  );
+  expect(container.querySelector("input")).toBeNull();
+  expect(publishes(harness)).toHaveLength(1);
+  await harness.click("Share review");
+  await harness.click("Share review");
+  await harness.settle();
+  expect(publishes(harness)).toHaveLength(2);
+  expect(container.querySelector("input")?.value).toContain("/s/capability");
+  expect(container.textContent).not.toContain("Link revoked");
 });
 
 it("polls only while sign-in is pending and stops when the control unmounts", async () => {
diff --git a/packages/review/app/src/share-control.tsx b/packages/review/app/src/share-control.tsx
index d0fbf626fa..4ed1249677 100644
--- a/packages/review/app/src/share-control.tsx
+++ b/packages/review/app/src/share-control.tsx
@@ -67,6 +67,9 @@ const actionError = (error: Error | null) =>
     ? error.message
     : "Could not complete this action. Please retry.");
 
+// Keeps focus in the popover when the control that had it goes away.
+const focusOnMount = (element: HTMLElement | null) => element?.focus();
+
 /** Whether this review can be shared, so a menu may offer Share. */
 export function useCanShare(): boolean {
   return useContext(SharingContext) !== null;
@@ -87,6 +90,7 @@ export function ShareControl({
   const [open, setOpen] = useState(false);
   const [target, setTarget] = useState<ShareTarget>();
   const [copyError, setCopyError] = useState<string>();
+  const [revoked, setRevoked] = useState(false);
   const control = useRef<HTMLDivElement>(null);
   const accountKey = canvasQueryKeys.sharingAccount();
 
@@ -143,6 +147,36 @@ export function ShareControl({
       context!.client.post<{ opened: true }>("/sharing/open", { url }),
   });
 
+  const revoke = useMutation({
+    mutationFn: (shareId: string) =>
+      context!.client.post("/sharing/revoke", { shareId }),
+    onSuccess: (_, shareId) => {
+      queryClient.removeQueries({ queryKey: linkKey });
+      queryClient.removeQueries({
+        queryKey: canvasQueryKeys.shareHistory(shareId),
+      });
+      setRevoked(true);
+    },
+  });
+
+  const confirm = session?.bridge.confirm;
+
+  const revokeLink = async (shareId: string) => {
+    if (!confirm || revoke.isPending) return;
+
+    const confirmed = await confirm({
+      message: "Revoke this share link?",
+      detail:
+        "Anyone with the link loses access to every version shared behind it.",
+      primaryButton: "Revoke",
+    });
+
+    // The host's dialog can dismiss the popover; bring it back.
+    setOpen(true);
+
+    if (confirmed) revoke.mutate(shareId);
+  };
+
   const upload = (next: ShareTarget) => {
     login.reset();
     publish.mutate(next);
@@ -160,6 +194,8 @@ export function ShareControl({
       publish.reset();
       login.reset();
       openRevision.reset();
+      revoke.reset();
+      setRevoked(false);
       setCopyError(undefined);
     }
 
@@ -194,16 +230,20 @@ export function ShareControl({
 
   // Upload once per opening; a failure waits for Retry or a new sign-in.
   useEffect(() => {
-    if (open && signedIn && target && publish.isIdle && !current)
+    if (open && signedIn && target && publish.isIdle && !current && !revoked)
       upload(target);
-  }, [open, signedIn, target, publish.isIdle, current]);
+  }, [open, signedIn, target, publish.isIdle, current, revoked]);
 
   if (!context) return null;
 
   const error =
     copyError ??
     actionError(
-      publish.error ?? login.error ?? openRevision.error ?? historyQuery.error,
+      publish.error ??
+        login.error ??
+        openRevision.error ??
+        revoke.error ??
+        historyQuery.error,
     );
 
   const accountError = accountQuery.isError
@@ -250,7 +290,16 @@ export function ShareControl({
             </p>
           )}
           {signedIn ? (
-            current ? (
+            revoked ? (
+              <p
+                ref={focusOnMount}
+                role="status"
+                tabIndex={-1}
+                {...stylex.props(styles.paragraph, styles.notice)}
+              >
+                Link revoked. Sharing this board again creates a new link.
+              </p>
+            ) : current ? (
               <>
                 <TextField
                   xstyle={styles.link}
@@ -289,6 +338,14 @@ export function ShareControl({
                     ))}
                   </ul>
                 )}
+                {confirm && (
+                  <Button
+                    variant="ghost"
+                    onClick={() => void revokeLink(current.shareId)}
+                  >
+                    Revoke link
+                  </Button>
+                )}
               </>
             ) : error ? (
               <Button
@@ -379,6 +436,9 @@ const styles = stylex.create({
   link: {
     width: "100%",
   },
+  notice: {
+    outline: "none",
+  },
   history: {
     margin: 0,
     padding: 0,

From 88f2ea9be615ad54a3139075e487fb0275527727 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:36:24 -0500
Subject: [PATCH 07/11] Cap the share history list's height and check it
 reloads after a reshare

Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/app/src/share-control.test.tsx | 13 ++++++++++++-
 packages/review/app/src/share-control.tsx      |  2 ++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/review/app/src/share-control.test.tsx b/packages/review/app/src/share-control.test.tsx
index 0811792bf5..568c811512 100644
--- a/packages/review/app/src/share-control.test.tsx
+++ b/packages/review/app/src/share-control.test.tsx
@@ -45,6 +45,7 @@ function mount(options: {
   const posts: Array<{ path: string; body: unknown }> = [];
   const telemetry: string[] = [];
   let accountReads = 0;
+  let historyReads = 0;
 
   const session = testReviewSession(
     {},
@@ -87,7 +88,9 @@ function mount(options: {
         });
       }
 
-      if (path.includes("/history/"))
+      if (path.includes("/history/")) {
+        historyReads += 1;
+
         return Response.json({
           latest: revision5,
           items: [
@@ -107,6 +110,7 @@ function mount(options: {
             },
           ],
         });
+      }
 
       if (path.endsWith("/open")) return Response.json({ opened: true });
 
@@ -201,6 +205,7 @@ function mount(options: {
     click,
     settle,
     accountReads: () => accountReads,
+    historyReads: () => historyReads,
   };
 }
 
@@ -466,6 +471,12 @@ it("lists the link's revisions newest first, marks the latest and opens one in t
     body: { url: u4 },
   });
   expect(container.textContent).not.toContain("Revoke link");
+  await harness.click("Share review");
+  await harness.render(6);
+  await harness.click("Share review");
+  await harness.settle();
+  expect(publishes(harness)).toHaveLength(2);
+  expect(harness.historyReads()).toBe(2);
 });
 
 it("revokes the link after the host confirms, and the next opening shares a new one", async () => {
diff --git a/packages/review/app/src/share-control.tsx b/packages/review/app/src/share-control.tsx
index 4ed1249677..8f87123a04 100644
--- a/packages/review/app/src/share-control.tsx
+++ b/packages/review/app/src/share-control.tsx
@@ -442,6 +442,8 @@ const styles = stylex.create({
   history: {
     margin: 0,
     padding: 0,
+    maxBlockSize: space.s120,
+    overflowY: "auto",
     listStyle: "none",
   },
   code: {

From fa76507782d6d572984dd05f49e63372fee807c0 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:39:25 -0500
Subject: [PATCH 08/11] Check share history and revoke end to end

Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 .../scripts/e2e/journeys/share-link.mjs       | 53 ++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/apps/review-desktop/scripts/e2e/journeys/share-link.mjs b/apps/review-desktop/scripts/e2e/journeys/share-link.mjs
index 64ec90d1d2..f356623380 100644
--- a/apps/review-desktop/scripts/e2e/journeys/share-link.mjs
+++ b/apps/review-desktop/scripts/e2e/journeys/share-link.mjs
@@ -1,4 +1,4 @@
-/** A board shared, edited and shared again keeps one link, with a revision per version. */
+/** A board shared, edited and shared again keeps one link, with a revision per version, until it is revoked. */
 import assert from "node:assert/strict";
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
@@ -11,6 +11,7 @@ export const name = "share-link";
 export const phase = 1;
 
 export const options = {
+  settings: { "window.dialogStyle": "custom" },
   async beforeLaunch(ctx) {
     ctx.service = await startShareService();
     await writeFile(
@@ -90,6 +91,56 @@ export async function run(ctx) {
     assert.equal(service.posts.length, 2);
     assert.equal(await input.inputValue(), u1);
     ctx.check("reopening an unchanged board uploads nothing");
+
+    const rows = page.locator("[data-share-revision]");
+
+    await ctx.until(async () => (await rows.count()) === 2, "two history rows");
+
+    const [latest, older] = await rows.allTextContents();
+
+    assert.match(
+      latest,
+      new RegExp(` · v${revisions.items[0].version} · .* · Latest$`),
+    );
+    assert.match(older, new RegExp(` · v${revisions.items[1].version} · `));
+    assert.doesNotMatch(older, /Latest/);
+    ctx.check("the popover lists both revisions, the newest marked Latest");
+
+    const revokeButton = page.getByRole("button", { name: "Revoke link" });
+
+    const dialog = ctx.page
+      .getByRole("dialog")
+      .filter({ hasText: "Revoke this share link?" });
+
+    const notice = page.getByText(
+      "Link revoked. Sharing this board again creates a new link.",
+    );
+
+    await revokeButton.click();
+    await dialog.getByRole("button", { name: "Cancel", exact: true }).click();
+    await dialog.waitFor({ state: "hidden" });
+    await input.waitFor();
+    assert.equal(service.links.get(reviewId)?.shareId, shareId);
+    ctx.check("cancelling the revoke keeps the link and the popover");
+
+    await revokeButton.click();
+    await dialog.getByRole("button", { name: "Revoke", exact: true }).click();
+    await notice.waitFor();
+    assert.equal(service.links.has(reviewId), false);
+    ctx.check("revoking deletes the link at the service");
+
+    await page.keyboard.press("Escape");
+    await notice.waitFor({ state: "detached" });
+    await button.click();
+    await ctx.until(
+      async () =>
+        service.posts.length === 3 &&
+        Boolean(await input.inputValue().catch(() => "")),
+      "the new link",
+    );
+    assert.notEqual(await input.inputValue(), u1);
+    assert.notEqual(service.links.get(reviewId).shareId, shareId);
+    ctx.check("sharing a revoked board again uploads a new link");
   } finally {
     await service.stop();
   }

From b0e59fdfdd77415c040c67e47994d096beab4e9f Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:59:41 -0500
Subject: [PATCH 09/11] Open share revisions on Windows and pass the normalized
 URL to the opener

Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/src/sharing/host.test.ts   | 10 +++++++++-
 packages/review/src/sharing/host.ts        | 12 +++++++-----
 packages/trace-core/src/store-auth.test.ts | 19 ++++++++++++++++++-
 packages/trace-core/src/store-auth.ts      | 17 +++++++++++++----
 4 files changed, 47 insertions(+), 11 deletions(-)

diff --git a/packages/review/src/sharing/host.test.ts b/packages/review/src/sharing/host.test.ts
index d962a1936d..47eab5b9e9 100644
--- a/packages/review/src/sharing/host.test.ts
+++ b/packages/review/src/sharing/host.test.ts
@@ -509,13 +509,21 @@ it("opens a share revision in the browser and refuses any other URL", async () =
       (await post("/sharing/open", { url: `${url}?rev=${R}` })).status,
     ).toBe(200);
     expect(openUrl).toHaveBeenCalledWith(`${url}?rev=${R}`);
+    expect(
+      (
+        await post("/sharing/open", {
+          url: ` HTTPS://APP.dev.fast:443/s/${capability}?rev=${R}`,
+        })
+      ).status,
+    ).toBe(200);
+    expect(openUrl).toHaveBeenLastCalledWith(`${url}?rev=${R}`);
 
     for (const url of [
       "https://evil.test/s/" + capability,
       "file:///etc/passwd",
     ])
       expect((await post("/sharing/open", { url })).status).toBe(400);
-    expect(openUrl).toHaveBeenCalledTimes(1);
+    expect(openUrl).toHaveBeenCalledTimes(2);
   } finally {
     await fixture.data.close();
     fixture.store.close();
diff --git a/packages/review/src/sharing/host.ts b/packages/review/src/sharing/host.ts
index 29dc26ad5d..d0395d4a0a 100644
--- a/packages/review/src/sharing/host.ts
+++ b/packages/review/src/sharing/host.ts
@@ -186,20 +186,22 @@ export function mountSharingHost(
       .strictObject({ url: z.string().max(2048) })
       .parse(await readBoundedRequestJson(context.req.raw));
 
-    const origin = (() => {
+    const link = (() => {
       try {
-        return parseShareLink(url).origin;
+        parseShareLink(url);
+
+        return new URL(url);
       } catch {
         return undefined;
       }
     })();
 
     if (
-      origin !== DEFAULT_STORE_ORIGIN &&
-      (!origin || origin !== (await readStoreAuth())?.origin)
+      link?.origin !== DEFAULT_STORE_ORIGIN &&
+      (!link || link.origin !== (await readStoreAuth())?.origin)
     )
       throw new ReviewInputError("Only Whiteboard share links open here.", 400);
-    await (options.openUrl ?? openUrlInBrowser)(url);
+    await (options.openUrl ?? openUrlInBrowser)(link.href);
 
     return context.json({ opened: true });
   });
diff --git a/packages/trace-core/src/store-auth.test.ts b/packages/trace-core/src/store-auth.test.ts
index d02b702242..4ba6edfba1 100644
--- a/packages/trace-core/src/store-auth.test.ts
+++ b/packages/trace-core/src/store-auth.test.ts
@@ -6,7 +6,12 @@ import { PassThrough } from "node:stream";
 import type { JsonValue } from "@dev.fast/json";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import { readStoreAuth, runStoreLogin, writeStoreAuth } from "./store-auth";
+import {
+  browserOpenCommand,
+  readStoreAuth,
+  runStoreLogin,
+  writeStoreAuth,
+} from "./store-auth";
 
 function json(body: JsonValue, status = 200): Response {
   return new Response(JSON.stringify(body), {
@@ -19,6 +24,18 @@ function outputStream(): PassThrough {
   return new PassThrough();
 }
 
+describe("browserOpenCommand", () => {
+  const url = "https://app.dev.fast/s/abc?rev=1&app=preview";
+
+  it.each([
+    ["darwin", ["open", [url]]],
+    ["linux", ["xdg-open", [url]]],
+    ["win32", ["rundll32.exe", ["url.dll,FileProtocolHandler", url]]],
+  ] as const)("opens URLs on %s", (platform, argv) => {
+    expect(browserOpenCommand(url, platform)).toEqual(argv);
+  });
+});
+
 describe("store-auth", () => {
   let tmp: string;
 
diff --git a/packages/trace-core/src/store-auth.ts b/packages/trace-core/src/store-auth.ts
index 65874bc271..82a7ec2be2 100644
--- a/packages/trace-core/src/store-auth.ts
+++ b/packages/trace-core/src/store-auth.ts
@@ -110,18 +110,27 @@ async function defaultSleep(ms: number): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-/** The command that opens a URL in the user's browser on this platform. */
+/** The command and arguments that open a URL in the browser on this platform.
+ * Windows skips `cmd /c start`, which splits URLs at `&`. */
 export function browserOpenCommand(
+  url: string,
   platform: NodeJS.Platform = process.platform,
-): string {
-  return platform === "darwin" ? "open" : "xdg-open";
+): [string, string[]] {
+  if (platform === "darwin") return ["open", [url]];
+
+  if (platform === "win32")
+    return ["rundll32.exe", ["url.dll,FileProtocolHandler", url]];
+
+  return ["xdg-open", [url]];
 }
 
 /** Opens a URL in the browser. Callers inject a stub in tests. */
 export async function openUrlInBrowser(url: string): Promise<void> {
   const { spawn } = await import("node:child_process");
 
-  const child = spawn(browserOpenCommand(), [url], {
+  const [command, args] = browserOpenCommand(url);
+
+  const child = spawn(command, args, {
     stdio: "ignore",
     detached: true,
   });

From 0517452deb082d8cca41950238336115f24208d2 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Sun, 1 Nov 2026 16:59:42 -0500
Subject: [PATCH 10/11] Keep history failures inline, guard the revoke prompt
 and share again after revoking

Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review-protocol/src/contracts.ts     |  1 +
 .../review/app/src/share-control.test.tsx     | 96 +++++++++++++++++++
 packages/review/app/src/share-control.tsx     | 59 ++++++++----
 3 files changed, 135 insertions(+), 21 deletions(-)

diff --git a/packages/review-protocol/src/contracts.ts b/packages/review-protocol/src/contracts.ts
index 00488b5b97..c073556428 100644
--- a/packages/review-protocol/src/contracts.ts
+++ b/packages/review-protocol/src/contracts.ts
@@ -404,6 +404,7 @@ export interface ReviewCanvasBridge {
     listener: (show: boolean) => void,
   ): ReviewDisposable;
   notify?(notification: ReviewNotification): ReviewDisposable;
+  /** Asks in the host's modal dialog; resolves true when the primary button is chosen. */
   confirm?(request: {
     message: string;
     detail?: string;
diff --git a/packages/review/app/src/share-control.test.tsx b/packages/review/app/src/share-control.test.tsx
index 568c811512..7abc4cf8ad 100644
--- a/packages/review/app/src/share-control.test.tsx
+++ b/packages/review/app/src/share-control.test.tsx
@@ -39,6 +39,7 @@ function mount(options: {
   holdVersion?: { version: number; until: Promise<void> };
   sender?: string;
   confirm?: () => Promise<boolean>;
+  historyStatus?: number;
 }) {
   vi.stubGlobal("IS_REACT_ACT_ENVIRONMENT", true);
   const state = { ...options };
@@ -91,6 +92,14 @@ function mount(options: {
       if (path.includes("/history/")) {
         historyReads += 1;
 
+        if (state.historyStatus === 401) state.signedIn = false;
+
+        if (state.historyStatus)
+          return Response.json(
+            { error: "History is unavailable." },
+            { status: state.historyStatus },
+          );
+
         return Response.json({
           latest: revision5,
           items: [
@@ -511,6 +520,93 @@ it("revokes the link after the host confirms, and the next opening shares a new
   expect(container.textContent).not.toContain("Link revoked");
 });
 
+it("shows a history failure under the link and keeps it usable", async () => {
+  const harness = mount({ signedIn: true, historyStatus: 500 });
+  const { container } = harness;
+
+  await harness.render(5);
+  await harness.click("Share review");
+  await vi.waitFor(async () => {
+    await harness.settle();
+    expect(container.textContent).toContain("Could not load share history.");
+  });
+  expect(container.querySelector("[role=alert]")).toBeNull();
+  expect(container.querySelector("input")?.value).toContain("/s/capability");
+  const dialog = container.querySelector("[role=dialog]")!;
+  expect(
+    [...dialog.children].findIndex((child) =>
+      child.textContent?.includes("Could not load share history."),
+    ),
+  ).toBeGreaterThan(
+    [...dialog.children].findIndex((child) => child.tagName === "INPUT"),
+  );
+  expect(
+    [...dialog.querySelectorAll("button")].map((button) => button.textContent),
+  ).toContain("Copy link");
+});
+
+it("shows sign-in when the history read finds the login expired", async () => {
+  const harness = mount({ signedIn: true, historyStatus: 401 });
+  const { container } = harness;
+
+  await harness.render(5);
+  await harness.settle();
+  await harness.click("Share review");
+  const reads = harness.accountReads();
+  await vi.waitFor(async () => {
+    await harness.settle();
+    expect(harness.accountReads()).toBeGreaterThan(reads);
+    expect(
+      [...container.querySelectorAll("[role=dialog] button")].map(
+        (button) => button.textContent,
+      ),
+    ).toContain("Sign in to share");
+  });
+});
+
+it("opens one confirmation while the first is unanswered", async () => {
+  let answer: (confirmed: boolean) => void = () => {};
+
+  const confirm = vi.fn<() => Promise<boolean>>(
+    () => new Promise((resolve) => (answer = resolve)),
+  );
+
+  const harness = mount({ signedIn: true, confirm });
+
+  await harness.render(5);
+  await harness.click("Share review");
+  await harness.settle();
+  await harness.click("Revoke link");
+  await harness.click("Revoke link");
+  expect(confirm).toHaveBeenCalledTimes(1);
+  await act(async () => answer(false));
+  await harness.click("Revoke link");
+  expect(confirm).toHaveBeenCalledTimes(2);
+});
+
+it("shares again from the revoked state without closing", async () => {
+  const harness = mount({ signedIn: true, confirm: async () => true });
+  const { container } = harness;
+
+  await harness.render(5);
+  await harness.click("Share review");
+  await harness.settle();
+  await harness.click("Revoke link");
+  await harness.settle();
+  expect(container.textContent).toContain("Link revoked");
+  await harness.click("Share again");
+  await harness.settle();
+
+  const [first, second] = publishes(harness).map(
+    (post) => (post.body as { requestId: string }).requestId,
+  );
+
+  expect(second).toBeDefined();
+  expect(second).not.toBe(first);
+  expect(container.querySelector("input")?.value).toContain("/s/capability");
+  expect(container.textContent).not.toContain("Link revoked");
+});
+
 it("polls only while sign-in is pending and stops when the control unmounts", async () => {
   vi.useFakeTimers({
     toFake: ["setTimeout", "clearTimeout", "setInterval", "clearInterval"],
diff --git a/packages/review/app/src/share-control.tsx b/packages/review/app/src/share-control.tsx
index 8f87123a04..f19f5d5ca5 100644
--- a/packages/review/app/src/share-control.tsx
+++ b/packages/review/app/src/share-control.tsx
@@ -160,16 +160,18 @@ export function ShareControl({
   });
 
   const confirm = session?.bridge.confirm;
+  const confirming = useRef(false);
 
   const revokeLink = async (shareId: string) => {
-    if (!confirm || revoke.isPending) return;
+    if (!confirm || confirming.current || revoke.isPending) return;
+    confirming.current = true;
 
     const confirmed = await confirm({
       message: "Revoke this share link?",
       detail:
         "Anyone with the link loses access to every version shared behind it.",
       primaryButton: "Revoke",
-    });
+    }).finally(() => (confirming.current = false));
 
     // The host's dialog can dismiss the popover; bring it back.
     setOpen(true);
@@ -182,20 +184,21 @@ export function ShareControl({
     publish.mutate(next);
   };
 
+  const shareAgain = () => {
+    setTarget({ version: context!.version, requestId: crypto.randomUUID() });
+    publish.reset();
+    setRevoked(false);
+  };
+
   const toggle = () => {
     if (!context) return;
 
     // An upload of this version in flight keeps its request.
     if (!open && !(publish.isPending && target?.version === context.version)) {
-      setTarget({
-        version: context.version,
-        requestId: crypto.randomUUID(),
-      });
-      publish.reset();
+      shareAgain();
       login.reset();
       openRevision.reset();
       revoke.reset();
-      setRevoked(false);
       setCopyError(undefined);
     }
 
@@ -228,6 +231,14 @@ export function ShareControl({
 
   const history = historyQuery.data;
 
+  useEffect(() => {
+    if (
+      historyQuery.error instanceof ReviewApiError &&
+      historyQuery.error.status === 401
+    )
+      void queryClient.invalidateQueries({ queryKey: accountKey });
+  }, [historyQuery.error]);
+
   // Upload once per opening; a failure waits for Retry or a new sign-in.
   useEffect(() => {
     if (open && signedIn && target && publish.isIdle && !current && !revoked)
@@ -239,11 +250,7 @@ export function ShareControl({
   const error =
     copyError ??
     actionError(
-      publish.error ??
-        login.error ??
-        openRevision.error ??
-        revoke.error ??
-        historyQuery.error,
+      publish.error ?? login.error ?? openRevision.error ?? revoke.error,
     );
 
   const accountError = accountQuery.isError
@@ -291,14 +298,19 @@ export function ShareControl({
           )}
           {signedIn ? (
             revoked ? (
-              <p
-                ref={focusOnMount}
-                role="status"
-                tabIndex={-1}
-                {...stylex.props(styles.paragraph, styles.notice)}
-              >
-                Link revoked. Sharing this board again creates a new link.
-              </p>
+              <>
+                <p
+                  ref={focusOnMount}
+                  role="status"
+                  tabIndex={-1}
+                  {...stylex.props(styles.paragraph, styles.notice)}
+                >
+                  Link revoked. Sharing this board again creates a new link.
+                </p>
+                <Button variant="primary" onClick={shareAgain}>
+                  Share again
+                </Button>
+              </>
             ) : current ? (
               <>
                 <TextField
@@ -338,6 +350,11 @@ export function ShareControl({
                     ))}
                   </ul>
                 )}
+                {historyQuery.isError && (
+                  <p {...stylex.props(styles.paragraph, styles.status)}>
+                    Could not load share history.
+                  </p>
+                )}
                 {confirm && (
                   <Button
                     variant="ghost"

From c11fa44313898f11b042e597b28c34bd67df3173 Mon Sep 17 00:00:00 2001
From: thesiti92 <aiansiti@outlook.com>
Date: Mon, 2 Nov 2026 12:42:33 -0500
Subject: [PATCH 11/11] Count account reads before the share popover opens in
 the expired-login test

Agent-Session: 61c94475-694a-4e46-8971-e0d703d3b344
Agent-Session: 196d7f0b-63a2-4186-84b0-5068df27bf9a
Agent-Session: b47f56d8-24aa-4d4f-95b3-4217b7ec9e00
Agent-Session: f2f8f3d8-5a50-4c15-8ad8-9c9308d4a110
Agent-Session: 2b04f44e-91c6-4568-8c57-c4a01b2828ad
Agent-Session: 226d831c-5d71-4f4d-8cdb-7b3c4f30284d
---
 packages/review/app/src/share-control.test.tsx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/review/app/src/share-control.test.tsx b/packages/review/app/src/share-control.test.tsx
index 7abc4cf8ad..aec293ac16 100644
--- a/packages/review/app/src/share-control.test.tsx
+++ b/packages/review/app/src/share-control.test.tsx
@@ -551,10 +551,11 @@ it("shows sign-in when the history read finds the login expired", async () => {
 
   await harness.render(5);
   await harness.settle();
-  await harness.click("Share review");
   const reads = harness.accountReads();
+  await harness.click("Share review");
   await vi.waitFor(async () => {
     await harness.settle();
+    expect(harness.historyReads()).toBe(1);
     expect(harness.accountReads()).toBeGreaterThan(reads);
     expect(
       [...container.querySelectorAll("[role=dialog] button")].map(