Only my workspace (limit a share link to your team)

What it is

A share link used to be open to anyone holding it, protected at most by a password, a view limit or an expiry date. Only my workspace adds a team-only option: the link keeps working for your teammates and is useless to anyone outside the workspace, even if it is forwarded.

It adds to the other protections rather than replacing them. A workspace-only share can still have a password, a view limit and an expiry date, and revoking it still ends it for everyone.

Where to find it

• A share's settings in the Shares view: the Who can open this link choice at the top of the edit form.
• Publish pasted content: the same choice, above Expires in.
• The Shares list shows a Workspace badge on a workspace-only share.

Only my workspace is available only when you belong to a workspace. Without one, the choice is greyed out and the hint says to join a workspace first.

How it behaves

• For a teammate opening the link in a browser: they see Sign in to view, choose Continue with Google, and land on the share once the sign-in confirms they are a current member of your workspace. Access lasts 15 minutes at a time and is rechecked after that, so someone removed from the workspace loses access within that window.
• For a teammate opening the link inside Omniscio: the app signs them in on its own and the share opens without a second sign-in.
• For anyone else: the sign-in page explains the link is only for the sender's workspace. Signing in with an account outside the workspace is refused with a plain message.
• You can always open your own workspace-only share.
• Saved versus live: changing the setting saves it on your computer at once, then tells the share server. The Shares list shows Workspace (saving) and the settings show Saved, but not live yet until the server confirms; until then the link still opens for anyone. Omniscio retries on its own.
• Switching back to Anyone with the link reopens the link on the next visit.
• Republishing a share keeps its setting, and publishing the same file again as workspace-only never hands back an existing open link.
• Nothing is cached publicly: a workspace-only share is never stored in the app's local share cache, never preloaded, and never edge-cached by the share site.

For agents

• CLI: POST /share/publish accepts viewAudience ("link" or "workspace"; omit for link). PATCH /share/:token takes the same field; when the field changes, the route waits for the share server and answers viewAudienceLive: true once the change is live, false when it is saved but not yet live. "workspace" from an account with no workspace answers 409.
• IPC: SHARE_UPDATE carries viewAudience in its patch; the renderer share row carries viewAudience and mirrorConfirmed (no unconfirmed change waiting for the server).
• Server: the share server refuses every route of a workspace-only share without a valid grant (POST /s/<token>/workspace-unlock issues one). Rules and mechanism: share-workspace-only-contract.md.
• Deploys: the change ships in both share servers (Firebase functions and amc-back's share-api), which Johnny's team deploys; until they do, the server ignores the setting and the app shows it as saved but not live.

Related

• shares-view.md — the Shares view, where the setting and the badge live
• share-comments.md — the separate "Who can read comments" setting
• share-cli.md — the CLI publish and update routes
• share-artifacts.md — the publish flow