Teach native public file sharing in the core ArchDev skill

archdev/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: archdev
-description: Core ArchDev workflow — use for anything involving ArchDev. Covers CLI setup, upgrades, login, and model access; archdev.json validation (check); repo onboarding and readiness (repo status); activity taxonomy mapping (repo map); harness hooks (repo hook setup); build-event reporting (log post, log post --event); prior lessons (log messages, log search, capability-gated log knowledge); artifact findings (log finding); lifecycle posts — start, lesson, abandoned, done, handoff, question (log --kind); agent activity (repo monitor); generating, saving, and sharing live Ask dashboards (archdev ask); mandatory PR CI and risk follow-through; published PR risk/scope (inspect metadata); and repository rules (rules, rules add, rules edit, rules disable). Load at session start whenever the archdev CLI is installed, the repo contains archdev.json, or the task touches plans, tasks, sessions, commits, PRs, or harness hooks.
+description: Core ArchDev workflow — use for anything involving ArchDev. Covers CLI setup, upgrades, login, and model access; archdev.json validation (check); repo onboarding and readiness (repo status); activity taxonomy mapping (repo map); harness hooks (repo hook setup); build-event reporting (log post, log post --event); prior lessons (log messages, log search, capability-gated log knowledge); artifact findings (log finding); lifecycle posts — start, lesson, abandoned, done, handoff, question (log --kind); agent activity (repo monitor); live Ask dashboards (archdev ask); public file sharing (archdev share); mandatory PR CI and risk follow-through; published PR risk/scope (inspect metadata); and repository rules (rules, rules add, rules edit, rules disable). Load at session start whenever the archdev CLI is installed, the repo contains archdev.json, or the task touches plans, tasks, sessions, commits, PRs, or harness hooks.
 ---
 
 # ArchDev
@@ -22,6 +22,11 @@ reference with the concrete commands.
 
 ## Pull Requests
 
+For visual/UI changes, include screenshots or a short recording in the PR
+description, preferably before/after captures. Use `archdev share` for hosting.
+**Exclude or redact sensitive data before uploading.** Visual evidence
+supplements, rather than replaces, automated tests.
+
 After opening a PR or pushing a new head, you must follow through on CI, risk
 and rule violations without waiting for another user request:
 
@@ -196,6 +201,35 @@ artifact ID from the error and retry `ask share`, not `ask create`.
 Inspect the Ask board before retrying an unconfirmed room write: a timeout
 can happen after the post was accepted, and a new share can duplicate it.
 
+## Publish files to the web
+
+Use `archdev share` when the user requests a public link for a file, screenshot,
+HTML report, or static demo, or to host non-sensitive PR visual evidence.
+Check `"$archdev" share --help` for `upload`, `show`,
+`complete`, `delete`, and `purge`; older CLIs do not support this group. Do not
+upgrade without approval. Read [sharing.md](references/sharing.md) for limits,
+retry handling, and administrative user purge.
+
+```sh
+# Review the file manifest locally: no login, upload, or team post.
+"$archdev" --json share upload report.html demo/ --dry-run
+# Publish requested files or non-sensitive PR visual evidence.
+"$archdev" --json share upload report.html demo/ --public
+"$archdev" --json share show <share-id>
+"$archdev" --json share delete <share-id>
+```
+
+Anyone with a URL can read the files. Publish only the requested content or
+non-sensitive PR visual evidence; review directory manifests and never upload
+secrets or private data. Hidden
+files and obvious credential files are excluded, but this is not a secret
+scanner. Uploading does not post to the Company Room or publish a PR.
+Return each share's `url`, ID, and expiry. Shares expire after 180 days.
+Directories preserve relative assets; use the explicit `index.html` URL when
+present, not a bare directory URL. Ownership is assigned from the authenticated
+ArchDev user, never from a local flag; public URLs include that user's immutable
+`usr_` ID, not their email address.
+
 ## Rules from a session
 
 When a user asks to turn a correction into a repository rule, follow

archdev/references/sharing.md

@@ -0,0 +1,82 @@
+# Public file sharing
+
+`archdev share` publishes static files through ArchDev's normal user login.
+No AWS CLI, bucket credentials, Pulumi login, or model provider is required.
+The gateway must have public sharing configured; a missing endpoint does not
+prove a share was deleted. Report configuration/authentication errors rather
+than switching to the repository's internal shared-credential uploader.
+
+## Upload and preview
+
+```sh
+"$archdev" --json share upload report.html screenshots/ --dry-run
+"$archdev" --json share upload report.html screenshots/ --public
+```
+
+Preview validates all inputs and prints their file manifests without logging in
+or writing anything remotely. Upload requires explicit `--public`. Non-sensitive
+screenshots and recordings used as PR visual evidence do not need separate
+upload approval; exclude or redact sensitive data before uploading. Other
+content still requires the user's request to publish. `--public` does not
+authorize unrelated content. Public publication cannot be undone for copies
+others already saved.
+
+Results contain a `shares` array in input order with each share's `id`,
+`user_id`, `url`, `expires_at`, and file manifest. Progress goes to stderr.
+Relative paths and content types are retained. A directory with `index.html`
+gets an explicit entry-file URL; a single-file input gets that file's URL.
+Directories without an entry file are collections, not browseable indexes:
+link an individual file from their manifest. There is no SPA routing or server
+execution. HTML is sandboxed: relative scripts, styles, images and module assets
+work; application cookies, service workers, forms, embedded frames, and external
+network dependencies are not supported.
+
+Limits: 1,000 files per share, 100 MiB per file, 500 MiB per share, 20 share
+reservations and 1 GiB reserved per user per UTC day, and 1,000 unexpired share
+reservations per user. Failed reservations can count toward quotas. Shares
+expire after 180 days; storage lifecycle cleanup is asynchronous. Hidden paths,
+`node_modules`, `.pem`/`.key` files, and common private SSH keys are excluded.
+Symlinks, special files, unsafe paths and non-UTF-8 filenames are rejected.
+These exclusions are not a comprehensive secret scanner. Review the preview.
+
+## Inspect, retry, and revoke
+
+```sh
+"$archdev" --json share show <share-id>
+"$archdev" --json share complete <share-id>
+"$archdev" --json share delete <share-id>
+```
+
+Only the uploader can inspect, complete, or delete a share. A share becomes
+public only after every uploaded file matches the manifest and finalization
+succeeds. `complete` safely retries finalization of an otherwise fully uploaded
+share; it does not upload missing files. If finalization times out, inspect the
+returned share ID before uploading again. Partial batch failures report already
+completed shares: keep their URLs instead of duplicating those uploads.
+
+A failed object upload attempts to delete its reservation. If cleanup failed,
+retry `delete` with the reported ID. Deletion revokes the link and erases file
+contents. Private zero-byte tombstones remain temporarily to prevent an
+outstanding upload grant from recreating deleted files. Cached/downloaded
+copies outside ArchDev cannot be revoked.
+
+## Uploader attribution and administrative purge
+
+Public URLs have `/u/<usr_ID>/<share_ID>/<relative-path>`; uploader identity is
+also recorded server-side. All backing objects are scoped under the immutable
+user ID. Anyone can identify the uploader ID from a URL without revealing their
+email or allowing them to choose a different owner.
+
+Only an operator-configured sharing administrator can run:
+
+```sh
+# Destructive: requires explicit user authorization for this target account.
+"$archdev" --json share purge --user <usr_ID> --confirm
+```
+
+Purge disables future sharing for that user, immediately revokes their public
+URLs, and erases all registered file payloads, including pending uploads. It
+does not delete the ArchDev account or touch another uploader's files. Retry
+an interrupted purge with the same user ID; completed cleanup is retained.
+The persistent block remains until an operator deliberately clears it. Do not
+purge an account merely to clean up one share; use `delete` instead.

plugins/antigravity/skills/archdev/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: archdev
-description: Core ArchDev workflow — use for anything involving ArchDev. Covers CLI setup, upgrades, login, and model access; archdev.json validation (check); repo onboarding and readiness (repo status); activity taxonomy mapping (repo map); harness hooks (repo hook setup); build-event reporting (log post, log post --event); prior lessons (log messages, log search, capability-gated log knowledge); artifact findings (log finding); lifecycle posts — start, lesson, abandoned, done, handoff, question (log --kind); agent activity (repo monitor); generating, saving, and sharing live Ask dashboards (archdev ask); mandatory PR CI and risk follow-through; published PR risk/scope (inspect metadata); and repository rules (rules, rules add, rules edit, rules disable). Load at session start whenever the archdev CLI is installed, the repo contains archdev.json, or the task touches plans, tasks, sessions, commits, PRs, or harness hooks.
+description: Core ArchDev workflow — use for anything involving ArchDev. Covers CLI setup, upgrades, login, and model access; archdev.json validation (check); repo onboarding and readiness (repo status); activity taxonomy mapping (repo map); harness hooks (repo hook setup); build-event reporting (log post, log post --event); prior lessons (log messages, log search, capability-gated log knowledge); artifact findings (log finding); lifecycle posts — start, lesson, abandoned, done, handoff, question (log --kind); agent activity (repo monitor); live Ask dashboards (archdev ask); public file sharing (archdev share); mandatory PR CI and risk follow-through; published PR risk/scope (inspect metadata); and repository rules (rules, rules add, rules edit, rules disable). Load at session start whenever the archdev CLI is installed, the repo contains archdev.json, or the task touches plans, tasks, sessions, commits, PRs, or harness hooks.
 ---
 
 # ArchDev
@@ -22,6 +22,11 @@ reference with the concrete commands.
 
 ## Pull Requests
 
+For visual/UI changes, include screenshots or a short recording in the PR
+description, preferably before/after captures. Use `archdev share` for hosting.
+**Exclude or redact sensitive data before uploading.** Visual evidence
+supplements, rather than replaces, automated tests.
+
 After opening a PR or pushing a new head, you must follow through on CI, risk
 and rule violations without waiting for another user request:
 
@@ -196,6 +201,35 @@ artifact ID from the error and retry `ask share`, not `ask create`.
 Inspect the Ask board before retrying an unconfirmed room write: a timeout
 can happen after the post was accepted, and a new share can duplicate it.
 
+## Publish files to the web
+
+Use `archdev share` when the user requests a public link for a file, screenshot,
+HTML report, or static demo, or to host non-sensitive PR visual evidence.
+Check `"$archdev" share --help` for `upload`, `show`,
+`complete`, `delete`, and `purge`; older CLIs do not support this group. Do not
+upgrade without approval. Read [sharing.md](references/sharing.md) for limits,
+retry handling, and administrative user purge.
+
+```sh
+# Review the file manifest locally: no login, upload, or team post.
+"$archdev" --json share upload report.html demo/ --dry-run
+# Publish requested files or non-sensitive PR visual evidence.
+"$archdev" --json share upload report.html demo/ --public
+"$archdev" --json share show <share-id>
+"$archdev" --json share delete <share-id>
+```
+
+Anyone with a URL can read the files. Publish only the requested content or
+non-sensitive PR visual evidence; review directory manifests and never upload
+secrets or private data. Hidden
+files and obvious credential files are excluded, but this is not a secret
+scanner. Uploading does not post to the Company Room or publish a PR.
+Return each share's `url`, ID, and expiry. Shares expire after 180 days.
+Directories preserve relative assets; use the explicit `index.html` URL when
+present, not a bare directory URL. Ownership is assigned from the authenticated
+ArchDev user, never from a local flag; public URLs include that user's immutable
+`usr_` ID, not their email address.
+
 ## Rules from a session
 
 When a user asks to turn a correction into a repository rule, follow

plugins/antigravity/skills/archdev/references/sharing.md

@@ -0,0 +1,82 @@
+# Public file sharing
+
+`archdev share` publishes static files through ArchDev's normal user login.
+No AWS CLI, bucket credentials, Pulumi login, or model provider is required.
+The gateway must have public sharing configured; a missing endpoint does not
+prove a share was deleted. Report configuration/authentication errors rather
+than switching to the repository's internal shared-credential uploader.
+
+## Upload and preview
+
+```sh
+"$archdev" --json share upload report.html screenshots/ --dry-run
+"$archdev" --json share upload report.html screenshots/ --public
+```
+
+Preview validates all inputs and prints their file manifests without logging in
+or writing anything remotely. Upload requires explicit `--public`. Non-sensitive
+screenshots and recordings used as PR visual evidence do not need separate
+upload approval; exclude or redact sensitive data before uploading. Other
+content still requires the user's request to publish. `--public` does not
+authorize unrelated content. Public publication cannot be undone for copies
+others already saved.
+
+Results contain a `shares` array in input order with each share's `id`,
+`user_id`, `url`, `expires_at`, and file manifest. Progress goes to stderr.
+Relative paths and content types are retained. A directory with `index.html`
+gets an explicit entry-file URL; a single-file input gets that file's URL.
+Directories without an entry file are collections, not browseable indexes:
+link an individual file from their manifest. There is no SPA routing or server
+execution. HTML is sandboxed: relative scripts, styles, images and module assets
+work; application cookies, service workers, forms, embedded frames, and external
+network dependencies are not supported.
+
+Limits: 1,000 files per share, 100 MiB per file, 500 MiB per share, 20 share
+reservations and 1 GiB reserved per user per UTC day, and 1,000 unexpired share
+reservations per user. Failed reservations can count toward quotas. Shares
+expire after 180 days; storage lifecycle cleanup is asynchronous. Hidden paths,
+`node_modules`, `.pem`/`.key` files, and common private SSH keys are excluded.
+Symlinks, special files, unsafe paths and non-UTF-8 filenames are rejected.
+These exclusions are not a comprehensive secret scanner. Review the preview.
+
+## Inspect, retry, and revoke
+
+```sh
+"$archdev" --json share show <share-id>
+"$archdev" --json share complete <share-id>
+"$archdev" --json share delete <share-id>
+```
+
+Only the uploader can inspect, complete, or delete a share. A share becomes
+public only after every uploaded file matches the manifest and finalization
+succeeds. `complete` safely retries finalization of an otherwise fully uploaded
+share; it does not upload missing files. If finalization times out, inspect the
+returned share ID before uploading again. Partial batch failures report already
+completed shares: keep their URLs instead of duplicating those uploads.
+
+A failed object upload attempts to delete its reservation. If cleanup failed,
+retry `delete` with the reported ID. Deletion revokes the link and erases file
+contents. Private zero-byte tombstones remain temporarily to prevent an
+outstanding upload grant from recreating deleted files. Cached/downloaded
+copies outside ArchDev cannot be revoked.
+
+## Uploader attribution and administrative purge
+
+Public URLs have `/u/<usr_ID>/<share_ID>/<relative-path>`; uploader identity is
+also recorded server-side. All backing objects are scoped under the immutable
+user ID. Anyone can identify the uploader ID from a URL without revealing their
+email or allowing them to choose a different owner.
+
+Only an operator-configured sharing administrator can run:
+
+```sh
+# Destructive: requires explicit user authorization for this target account.
+"$archdev" --json share purge --user <usr_ID> --confirm
+```
+
+Purge disables future sharing for that user, immediately revokes their public
+URLs, and erases all registered file payloads, including pending uploads. It
+does not delete the ArchDev account or touch another uploader's files. Retry
+an interrupted purge with the same user ID; completed cleanup is retained.
+The persistent block remains until an operator deliberately clears it. Do not
+purge an account merely to clean up one share; use `delete` instead.