@celsoft/coordinator 0.0.0 → 0.1.0

package/skills/extra/skills/questions/assets/index.html

@@ -0,0 +1,376 @@
+<title>Open Questions</title>
+<style>
+:root {
+  --bg: #f5f7f8; --surface: #ffffff; --fg: #17212b; --muted: #5b6875; --line: #d9e0e5;
+  --accent: #0f6b6e; --accent-soft: #e0f0ef; --note: #8a5a00; --note-soft: #fbf0d9;
+  --reply: #eef2f7; --pro: #e6f4ea; --pro-fg: #1e6b35; --con: #fbe9e7; --con-fg: #9a3412;
+}
+@media (prefers-color-scheme: dark) {
+  :root:not([data-theme="light"]) {
+    --bg: #11171c; --surface: #182128; --fg: #e4eaee; --muted: #94a2ae; --line: #2a3640;
+    --accent: #4fc1bf; --accent-soft: #163634; --note: #e8b45a; --note-soft: #3a2c12;
+    --reply: #1d2a33; --pro: #15301f; --pro-fg: #7fd69a; --con: #3a1d17; --con-fg: #f4a48c; color-scheme: dark;
+  }
+}
+:root[data-theme="dark"] {
+  --bg: #11171c; --surface: #182128; --fg: #e4eaee; --muted: #94a2ae; --line: #2a3640;
+  --accent: #4fc1bf; --accent-soft: #163634; --note: #e8b45a; --note-soft: #3a2c12;
+  --reply: #1d2a33; --pro: #15301f; --pro-fg: #7fd69a; --con: #3a1d17; --con-fg: #f4a48c; color-scheme: dark;
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0; background: var(--bg); color: var(--fg); padding: 0 16px 48px;
+  font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+}
+main { max-width: 760px; margin: 0 auto; display: flex; flex-direction: column; gap: 28px; }
+header.top { padding-top: 32px; display: flex; flex-direction: column; gap: 6px; }
+h1 { font-size: 26px; line-height: 1.2; margin: 0; }
+.lede { color: var(--muted); margin: 0; max-width: 62ch; }
+.problem { margin: 12px 0 0; padding: 10px 12px; border-left: 3px solid var(--accent); background: var(--bg); border-radius: 0 6px 6px 0; max-width: 62ch; }
+.problem strong { display: block; font-size: 12px; letter-spacing: .04em; text-transform: uppercase; color: var(--muted); margin-bottom: 2px; }
+.tally {
+  position: sticky; top: 0; z-index: 5; background: var(--bg);
+  display: flex; flex-wrap: wrap; gap: 8px 16px; align-items: center; padding-block: 10px;
+  border-bottom: 1px solid var(--line); font-variant-numeric: tabular-nums; font-size: 14px;
+}
+.meter { flex: 1 1 160px; height: 6px; background: var(--line); border-radius: 3px; overflow: hidden; min-width: 120px; }
+.meter > div { height: 100%; background: var(--accent); width: 0; transition: width .25s ease; }
+.status-line { color: var(--muted); font-size: 13px; }
+.done {
+  font: inherit; font-size: 14px; font-weight: 600; color: #fff; background: var(--accent);
+  border: 0; border-radius: 6px; padding: 6px 12px; cursor: pointer;
+}
+.done:disabled { opacity: .6; cursor: default; }
+section { display: flex; flex-direction: column; gap: 12px; }
+section > h2 { font-size: 13px; letter-spacing: .08em; text-transform: uppercase; color: var(--muted); margin: 0; font-weight: 600; }
+section > p.group-note { margin: -4px 0 0; color: var(--muted); font-size: 14px; }
+.item {
+  background: var(--surface); border: 1px solid var(--line); border-radius: 10px;
+  padding: 16px; display: flex; flex-direction: column; gap: 12px;
+}
+.item.approved { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
+.item h3 { margin: 0; font-size: 17px; line-height: 1.3; }
+.item p { margin: 0; }
+.item .why { color: var(--muted); font-size: 14px; }
+.item .why::before { content: "Why this came up: "; font-weight: 600; color: var(--fg); }
+.item .versus { font-size: 14px; border-left: 3px solid var(--line); padding-left: 10px; }
+.item .versus::before { content: "Compared with: "; font-weight: 600; }
+.tradeoffs { display: grid; grid-template-columns: 1fr 1fr; gap: 10px; }
+.side { border-radius: 8px; padding: 10px 12px; }
+.side h4 { margin: 0 0 4px; font-size: 12px; letter-spacing: .06em; text-transform: uppercase; }
+.side ul { margin: 0; padding-left: 18px; font-size: 14px; }
+.side li + li { margin-top: 3px; }
+.side.pros { background: var(--pro); }
+.side.pros h4 { color: var(--pro-fg); }
+.side.cons { background: var(--con); }
+.side.cons h4 { color: var(--con-fg); }
+.side .none { color: var(--muted); font-size: 14px; }
+.reply { background: var(--reply); border-radius: 8px; padding: 8px 10px; font-size: 14px; }
+.reply::before { content: "Claude: "; font-weight: 600; }
+.answer { border-top: 1px solid var(--line); padding-top: 12px; display: flex; flex-direction: column; gap: 8px; }
+.approve { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+.approve label { display: inline-flex; align-items: center; gap: 8px; font-weight: 600; cursor: pointer; }
+.approve input { width: 20px; height: 20px; margin: 0; accent-color: var(--accent); cursor: pointer; }
+.chips { display: flex; gap: 6px; flex-wrap: wrap; }
+.chip { font-size: 12px; padding: 1px 8px; border-radius: 10px; background: var(--line); color: var(--muted); }
+.chip.ok { background: var(--accent-soft); color: var(--accent); }
+.chip.c { background: var(--note-soft); color: var(--note); }
+.answer .label { font-size: 13px; color: var(--muted); }
+@media (max-width: 560px) { .tradeoffs { grid-template-columns: 1fr; } }
+textarea {
+  width: 100%; min-height: 38px; resize: vertical; font: inherit; font-size: 14px;
+  color: var(--fg); background: var(--bg); border: 1px solid var(--line); border-radius: 6px; padding: 7px 9px;
+}
+textarea:focus-visible, input:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+code { font: .88em ui-monospace, SFMono-Regular, Menlo, monospace; background: var(--bg); padding: 0 4px; border-radius: 3px; overflow-wrap: anywhere; }
+.notice { background: var(--note-soft); color: var(--note); padding: 10px 12px; border-radius: 6px; font-size: 14px; }
+.empty { color: var(--muted); }
+@media (prefers-reduced-motion: reduce) { .meter > div { transition: none; } }
+</style>
+
+<main>
+  <header class="top">
+    <h1 id="title">Open Questions</h1>
+    <p class="lede" id="intro">Approve a proposal as written, or comment to change it or ask about it. Answers save as you type, and Claude reads them back.</p>
+    <p class="problem" id="problem" hidden><strong>Problem to solve</strong><span id="problem-text"></span></p>
+  </header>
+  <div class="tally" aria-live="polite">
+    <span><strong id="n-approved">0</strong> of <span id="n-total">0</span> approved</span>
+    <span><strong id="n-commented">0</strong> with comments</span>
+    <div class="meter" aria-hidden="true"><div id="meter"></div></div>
+    <span class="status-line" id="status">Loading</span>
+    <button class="done" id="done" type="button" hidden>Done, tell Claude</button>
+  </div>
+  <div id="notice" class="notice" hidden></div>
+  <div id="groups"></div>
+</main>
+
+<script>
+let GROUPS = [];
+let ALL = [];
+const state = {};
+const timers = {};
+let db = null;
+
+// Item text may use `code` and **bold**; everything else is plain text.
+function inline(target, text) {
+  target.replaceChildren();
+  for (const part of String(text ?? "").split(/(`[^`]+`|\*\*[^*]+\*\*)/)) {
+    if (!part) continue;
+    let node;
+    if (part.startsWith("`") && part.endsWith("`") && part.length > 1) {
+      node = document.createElement("code");
+      node.textContent = part.slice(1, -1);
+    } else if (part.startsWith("**") && part.endsWith("**") && part.length > 3) {
+      node = document.createElement("strong");
+      node.textContent = part.slice(2, -2);
+    } else {
+      node = document.createTextNode(part);
+    }
+    target.append(node);
+  }
+}
+
+function notice(text) {
+  const el = document.getElementById("notice");
+  el.textContent = text;
+  el.hidden = false;
+}
+
+function render() {
+  const root = document.getElementById("groups");
+  root.replaceChildren();
+  if (ALL.length === 0) {
+    const p = document.createElement("p");
+    p.className = "empty";
+    p.textContent = "Nothing is open right now.";
+    root.append(p);
+  }
+  for (const g of GROUPS) {
+    if (!g.items?.length) continue;
+    const sec = document.createElement("section");
+    const h2 = document.createElement("h2");
+    h2.textContent = g.title ?? "";
+    sec.append(h2);
+    if (g.note) {
+      const note = document.createElement("p");
+      note.className = "group-note";
+      inline(note, g.note);
+      sec.append(note);
+    }
+    for (const it of g.items) {
+      const el = document.createElement("div");
+      el.className = "item";
+      el.id = "item-" + it.id;
+
+      const h3 = document.createElement("h3");
+      inline(h3, it.title);
+      el.append(h3);
+      for (const [key, cls] of [["why", "why"], ["proposal", "proposal"], ["versus", "versus"]]) {
+        if (!it[key]) continue;
+        const p = document.createElement("p");
+        p.className = cls;
+        inline(p, it[key]);
+        el.append(p);
+      }
+
+      const tradeoffs = document.createElement("div");
+      tradeoffs.className = "tradeoffs";
+      for (const [key, heading] of [["pros", it.versus ? "Better than that" : "Pros"], ["cons", it.versus ? "Worse than that" : "Cons"]]) {
+        const side = document.createElement("div");
+        side.className = "side " + key;
+        const h4 = document.createElement("h4");
+        h4.textContent = heading;
+        side.append(h4);
+        const points = Array.isArray(it[key]) ? it[key] : [];
+        if (points.length) {
+          const ul = document.createElement("ul");
+          for (const point of points) {
+            const li = document.createElement("li");
+            inline(li, point);
+            ul.append(li);
+          }
+          side.append(ul);
+        } else {
+          const none = document.createElement("p");
+          none.className = "none";
+          none.textContent = "None";
+          side.append(none);
+        }
+        tradeoffs.append(side);
+      }
+      el.append(tradeoffs);
+
+      if (it.reply) {
+        const reply = document.createElement("p");
+        reply.className = "reply";
+        inline(reply, it.reply);
+        el.append(reply);
+      }
+
+      const answer = document.createElement("div");
+      answer.className = "answer";
+      const approve = document.createElement("div");
+      approve.className = "approve";
+      const label = document.createElement("label");
+      const cb = document.createElement("input");
+      cb.type = "checkbox";
+      cb.addEventListener("change", () => save(it.id, { approved: cb.checked }));
+      label.append(cb, document.createTextNode("Approve"));
+      const chips = document.createElement("div");
+      chips.className = "chips";
+      approve.append(label, chips);
+
+      const commentLabel = document.createElement("label");
+      commentLabel.className = "label";
+      commentLabel.textContent = "Comment";
+      const tx = document.createElement("textarea");
+      tx.id = "tx-" + it.id;
+      commentLabel.htmlFor = tx.id;
+      tx.rows = 2;
+      tx.placeholder = "Change it, ask about it, or pick another option";
+      tx.addEventListener("input", () => {
+        clearTimeout(timers[it.id]);
+        timers[it.id] = setTimeout(() => save(it.id, { comment: tx.value }), 700);
+      });
+      answer.append(approve, commentLabel, tx);
+      el.append(answer);
+      sec.append(el);
+    }
+    root.append(sec);
+  }
+  ALL.forEach((it) => paint(it.id));
+  tally();
+}
+
+function paint(id) {
+  const el = document.getElementById("item-" + id);
+  if (!el) return;
+  const s = state[id] || {};
+  const tx = el.querySelector("textarea");
+  el.querySelector(".approve input").checked = !!s.approved;
+  if (document.activeElement !== tx) tx.value = s.comment || "";
+  el.classList.toggle("approved", !!s.approved);
+  const chips = el.querySelector(".chips");
+  chips.replaceChildren();
+  const add = (text, cls) => {
+    const span = document.createElement("span");
+    span.className = "chip " + cls;
+    span.textContent = text;
+    chips.append(span);
+  };
+  add(s.approved ? "Approved" : "Open", s.approved ? "ok" : "");
+  if ((s.comment || "").trim()) add("Commented", "c");
+  tally();
+}
+
+function tally() {
+  const approved = ALL.filter((it) => state[it.id]?.approved).length;
+  const commented = ALL.filter((it) => (state[it.id]?.comment || "").trim()).length;
+  document.getElementById("n-approved").textContent = approved;
+  document.getElementById("n-total").textContent = ALL.length;
+  document.getElementById("n-commented").textContent = commented;
+  document.getElementById("meter").style.width = (ALL.length ? (100 * approved) / ALL.length : 100) + "%";
+}
+
+async function save(id, patch) {
+  state[id] = { ...(state[id] || {}), ...patch };
+  paint(id);
+  if (!db) return;
+  const status = document.getElementById("status");
+  status.textContent = "Saving";
+  try {
+    await db.collection("responses").doc(id).set({
+      approved: !!state[id].approved,
+      comment: state[id].comment || "",
+      updatedAt: new Date().toISOString(),
+    });
+    status.textContent = "Saved";
+  } catch {
+    status.textContent = "Not saved";
+  }
+}
+
+// Tells the Claude session watching this page that the viewer has finished answering.
+async function offerDone() {
+  const button = document.getElementById("done");
+  let comments = null;
+  try {
+    comments = await window.claude?.use?.("comments");
+  } catch {
+    comments = null;
+  }
+  if (!comments?.sendToClaude) return;
+  const check = async () => {
+    try {
+      return (await comments.canSendToClaude()) === "available";
+    } catch {
+      return false;
+    }
+  };
+  button.hidden = !(await check());
+  button.addEventListener("click", async () => {
+    const status = document.getElementById("status");
+    if (!(await check())) {
+      status.textContent = "Claude is not listening";
+      return;
+    }
+    button.disabled = true;
+    try {
+      const anchor = await comments.anchorFor(document.getElementById("title"));
+      await comments.sendToClaude({ anchor, text: "Done answering. Read the responses and settle them." });
+      status.textContent = "Sent to Claude";
+    } catch {
+      status.textContent = "Could not reach Claude";
+    } finally {
+      button.disabled = false;
+    }
+  });
+}
+
+(async () => {
+  const status = document.getElementById("status");
+  try {
+    const data = await (await fetch("questions.json", { cache: "no-cache" })).json();
+    if (data.title) {
+      document.getElementById("title").textContent = data.title;
+      document.title = data.title;
+    }
+    if (data.intro) inline(document.getElementById("intro"), data.intro);
+    if (data.problem) {
+      inline(document.getElementById("problem-text"), data.problem);
+      document.getElementById("problem").hidden = false;
+    }
+    GROUPS = Array.isArray(data.groups) ? data.groups : [];
+    ALL = GROUPS.flatMap((g) => g.items || []);
+  } catch (error) {
+    status.textContent = "Not loaded";
+    return notice("Could not read questions.json: " + error.message);
+  }
+  render();
+  offerDone();
+
+  try {
+    db = await window.claude?.use?.("db");
+  } catch {
+    db = null;
+  }
+  if (!db) {
+    status.textContent = "Not saving";
+    return notice("Saving is unavailable in this view, so ticks and comments will not be kept. Open the artifact signed in to record them.");
+  }
+  db.collection("responses").onSnapshot(
+    (snap) => {
+      for (const d of snap.docs) {
+        const data = d.data() || {};
+        state[d.id] = { approved: !!data.approved, comment: data.comment || "" };
+        paint(d.id);
+      }
+      status.textContent = "Up to date";
+    },
+    () => {
+      status.textContent = "Not saving";
+    },
+  );
+})();
+</script>

package/skills/extra/skills/questions/scripts/stage

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#
+# stage: prepare the questions page for one topic.
+#
+# Usage: stage <out-dir>
+# Copies the renderer and, when missing, writes an empty questions.json to fill in.
+# Prints the two paths to publish, one per line.
+
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+  echo "usage: stage <out-dir>" >&2
+  exit 2
+fi
+
+out=$1
+here=$(cd "$(dirname "$0")/.." && pwd)
+
+mkdir -p "$out"
+cp "$here/assets/index.html" "$out/index.html"
+if [ ! -f "$out/questions.json" ]; then
+  printf '{\n  "title": "",\n  "intro": "",\n  "groups": []\n}\n' > "$out/questions.json"
+fi
+
+echo "PAGE: $out/index.html"
+echo "QUESTIONS: $out/questions.json"

package/skills/extra/skills/serve/SKILL.md

@@ -0,0 +1,165 @@
+---
+name: serve
+description: "Serve local HTML or static assets over HTTP with live reload, on localhost or reachable from another device over the LAN or Tailscale, so a page can be opened in a real browser instead of as a file:// URL. Use when the user asks to serve, preview, or open a local page or static site, or when something you built needs a real HTTP origin (fetch, modules, CORS, service workers). Not for running an app's own dev server: use that project's start command instead."
+verified: 2026-08-24
+---
+
+# Serve a local file over HTTP
+
+One command, no setup, no config file, no dependency install. `scripts/serve` runs a
+detached python3 server per target.
+
+## The one rule: name what gets served
+
+**The server serves exactly what your `--allow` patterns match, and nothing else. There are
+no other content checks.** No gitignore awareness, no dotfile skipping, no secret detection.
+A pattern that reaches a `.env`, a private key, or `.git/` will serve it, to whoever can
+reach the port.
+
+So **you** choose the patterns, and you choose them narrowly. This is a real decision, not a
+formality: get it wrong and you publish a credential.
+
+1. **Start from the entry file.** `--allow 'report.html'` is a complete, safe answer for a
+   single page.
+2. **Add only the asset paths that page actually needs**, scoped to a directory:
+   `--allow 'assets/**' --allow 'css/*.css'`.
+3. **Never reach for `**` or `**/*`** to save yourself from reading the page. Serving a whole
+   tree is the failure mode this design exists to prevent.
+4. **Look before you widen.** `ls` the directory you are about to match. If a pattern would
+   pull in anything you cannot name and vouch for, tighten it.
+
+Running with no `--allow` at all serves the entire tree under the root. The wrapper prints
+`WARNING: no --allow given; the entire tree under ROOT is served.` Treat that warning as a
+bug in your invocation. Do it only if the user explicitly asked for a whole directory and
+you have told them plainly what is in it.
+
+## Start
+
+```bash
+scripts/serve start <file-or-dir> --allow '<glob>' [--allow '<glob>' ...]
+```
+
+- A **file** serves its parent directory and auto-scopes the allowlist to just that file.
+  `serve start report.html` is already narrow; no `--allow` needed.
+- A **directory** needs explicit patterns. Patterns are globs relative to the root, with
+  stdlib `glob` semantics (`*`, `?`, `[abc]`, and `**` for recursive).
+- `index.html` is used as the directory index when a pattern matches it.
+- Prints `URL:`, `ID:`, `ROOT:`, `RELOAD:`, `BIND:`, `ALLOW:`, `MATCHED:`, `IDLE_MINUTES:`,
+  `LOG:`, one per line.
+
+**Check `MATCHED:` before handing over the URL.** It is the file count your patterns
+resolved to. A number far larger than you expected means a pattern is too broad: stop and
+tighten it rather than shipping the URL.
+
+Give the user the `URL:` line. Do not open the browser yourself unless asked.
+
+Flags:
+
+| Flag | Effect |
+| --- | --- |
+| `--allow GLOB` | Serve files matching this glob, relative to the root. Repeatable. |
+| `--idle MIN` | Shut down after MIN minutes with no requests. Default 30. |
+| `--no-reload` | Serve bytes verbatim, no injected script. |
+| `--bind WHERE` | `local` (default), `lan`, `tailscale`, or a literal address. |
+
+**Leave `--idle` alone.** The 30 minute default is what stops a forgotten server running
+for days. `--idle 0` disables shutdown entirely and is almost never what you want: a server
+left on `lan` or `tailscale` with no timeout stays reachable to other machines indefinitely.
+Pass it only when the user explicitly asks for a server that outlives the session, and say
+plainly that it will run until stopped.
+
+**The script owns the port.** It picks the first free one and puts it in the URL it prints.
+Never choose, check, or mention a port: just relay the `URL:` line.
+
+## Choosing the bind target
+
+Run this first and offer the user the targets it reports as available:
+
+```bash
+scripts/serve hosts
+```
+
+It prints one line per target (`local: 127.0.0.1 localhost`, `lan: <ip> <ip>`,
+`tailscale: <ip> <magicdns-name>`) or `UNAVAILABLE` for one that cannot be resolved
+(no default route, Tailscale not installed or logged out).
+
+**Ask with `AskUserQuestion`, not in prose**, offering only the available targets:
+
+- **Local (recommended):** `127.0.0.1`, this machine only.
+- **LAN:** reachable from other devices on the same network, e.g. a phone on the same wifi.
+- **Tailscale:** reachable from your tailnet devices anywhere, over the MagicDNS name.
+
+Skip the prompt only when the user already named the target ("serve it on tailscale", "just
+localhost").
+
+Each target binds **that address only**, so a Tailscale server is not exposed to the LAN and
+vice versa. Widen the bind and the allowlist matters more, not less: tighten patterns before
+choosing `lan` or `tailscale`.
+
+## Manage
+
+```bash
+scripts/serve hosts             # available bind targets
+scripts/serve list              # id, url, root for every live server
+scripts/serve stop <id|port>    # or: stop all
+scripts/serve log <id|port>     # recent requests; -n N for more lines
+```
+
+Servers outlive the session, so `list` first rather than starting a second one for the same
+directory. Dead entries are reaped automatically.
+
+## Live reload
+
+Reload is **on by default**. The server injects a small script before `</body>` of every HTML
+response; it long-polls `/__reload`, and the browser reloads when any **allowed** file
+changes. So editing a file is enough: never tell the user to refresh, and never restart the
+server after an edit.
+
+Consequences worth knowing:
+
+- **Patterns are re-evaluated as it runs.** A file created later that matches an existing
+  pattern is served, and triggers a reload, with no restart. A pattern is a standing
+  instruction, not a one-time snapshot: another reason to keep it narrow.
+- **HTML is modified in flight.** Use `--no-reload` when byte-for-byte output matters.
+- **An open tab keeps the server alive**, because its polling counts as traffic. The idle
+  timer fires once the last tab closes.
+- **Reload polls are excluded from the log**, so `serve log` shows only real requests.
+
+## Reading the log to debug a page
+
+`serve log` is the fastest way to find out why a page looks wrong. Two lines matter:
+
+- **`404`** on an asset: the file is missing, or your patterns do not cover it. Check the
+  patterns first; a missing stylesheet is usually an allowlist gap, not a missing file.
+- **`BLOCKED "<path>" (no allow pattern matches)`:** the page asked for something outside
+  the allowlist. Widen deliberately and narrowly, or leave it blocked.
+
+## What the server guarantees on its own
+
+Only these, and they are about paths, not content:
+
+- **Requests cannot escape the root.** `../` and percent-encoded traversal are refused.
+- **A match that resolves outside the root is dropped**, so a symlink in the tree cannot
+  be used to reach `/etc/hosts` or a sibling repo.
+- **Only files are served.** Directories resolve to an index or a listing of allowed files.
+
+Everything else is your patterns. The server will not second-guess them.
+
+## Failure
+
+`scripts/serve` reports `FAIL: <reason>` and exits non-zero.
+
+- **`python3 not found`:** install it with `xcode-select --install` (the Command Line Tools
+  carry it) or `brew install python`.
+- **`no free port`:** everything in 8000-8099 is taken; `serve list` and `serve stop`
+  something.
+- **`bind target ... is unavailable`:** run `serve hosts` and pick a target it lists.
+- **`server did not start`:** the last 20 log lines are printed above the failure.
+
+## Not this skill
+
+- **A project's own dev server** (Vite, Next, Django, `mise run dev`): run that instead;
+  this serves static files only, with no build step and no API.
+- **Sharing a page with someone outside your network:** publish an Artifact, or deploy it to
+  a static host. `--bind lan` reaches the local network only and `--bind tailscale`
+  reaches your tailnet only; neither is a public URL.