npm - @cloudglue/tinycloud - Versions diffs - 0.3.12 → 0.3.14 - Mend

@cloudglue/tinycloud 0.3.12 → 0.3.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/README.md +2 -2
package/package.json +1 -1
package/skills/tinycloud/SKILL.md +16 -1
package/skills/tinycloud/reference/glossary.md +14 -2
package/skills/tinycloud/reference/verbs.md +65 -4
package/skills/tinycloud/scripts/preflight.sh +2 -2
package/skills/tinycloud/tinycloud-skill.json +4 -3

package/README.md CHANGED Viewed

@@ -17,11 +17,11 @@ The npm package is a small launcher: on first run it downloads the matching
 platform distribution from Cloudglue's CDN (cached under
 `~/.tinycloud/versions/<version>/`), verifies its checksum, and execs the real
 binary. The package version pins the binary version, so
-`npx @cloudglue/tinycloud@0.3.12` always runs tinycloud 0.3.12. It also adds two
+`npx @cloudglue/tinycloud@0.3.14` always runs tinycloud 0.3.14. It also adds two
 wrapper commands:
 ```bash
-tinycloud install --version 0.3.12   # pre-download a version
+tinycloud install --version 0.3.14   # pre-download a version
 tinycloud install --latest          # install latest stable and pin to it
 tinycloud update                    # move to latest stable, prune old versions
 ```

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@cloudglue/tinycloud",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "Agent CLI for deep video and image work, by Cloudglue. Downloads the tinycloud binary on first run.",
   "bin": {
     "tinycloud": "bin/tinycloud.js"

package/skills/tinycloud/SKILL.md CHANGED Viewed

@@ -206,12 +206,27 @@ Authoring your own recipes: [reference/workflow-authoring.md](reference/workflow
   `data.embed_snippet` (`<cg-video>`), which only plays on a private site of
   the same account. When writing HTML around an embed, use the component's
   built-ins (`autoplay`+`muted`, `loop`, `start-time`, `exclusive`,
+  `playbackrates` — speed-menu rates, default `1 1.5 2`, shown at every
+  player size; embed v7 —
   `clip-start`/`clip-end` to frame one "back to moment" clip — plus
   `clip-only`, 0.3.8+, to play nothing but that window; JS
-  `playSegment(start, end?)`) and the container components
+  `playSegment(start, end?)`, `playbackRate` get/set) and the container components
   (`<cg-playlist>`, `<cg-grid>`, `<cg-chapters>`) rather than hand-rolled
   players, galleries, or segment-list JS — details in
   [reference/verbs.md](reference/verbs.md).
+- Link previews (0.3.14+): how a pasted link unfurls in Slack/iMessage/Notion.
+  A **public** site's card comes from the HTML you generate — put `og:title`,
+  `og:description`, `og:image` (absolute URL — a share's `preview_url` works),
+  `og:url`, and `twitter:card` in the `<head>` of every public page, or the
+  link renders as a bare URL (bots don't run JS; never emit
+  `twitter:player`/`og:video`). A **private** site or share never reaches the
+  bot, so its card is off by default — opt in with `--link-preview full`
+  (private sites also take `--preview-title` / `--preview-image`; a private
+  share reuses its own title, description, and thumbnail). ⚠️ Ask the user
+  before turning it on: it makes those card fields readable by anyone with the
+  link (content and playback stay sign-in gated), and platforms cache per exact
+  URL, so turning it back off does not retract posted cards. Details in
+  [reference/verbs.md](reference/verbs.md).
 - Live-API discovery components (0.3.6+): the same embed script also defines
   collection-scoped, **private-site-only** elements that let viewers search/chat
   inside a published site — `<cg-chat>`, `<cg-search>`, `<cg-deep-search>`,

package/skills/tinycloud/reference/glossary.md CHANGED Viewed

@@ -122,12 +122,24 @@ connector?" or an envelope field needs explaining.
   embed via the `data.embed_snippet` `<cg-video>` tag, which only plays on a
   private published site of the same account. The embed has playback
   attributes (`autoplay`+`muted`, `loop`, `start-time`, `poster`,
-  `accent-color`, `exclusive`, and `clip-start`/`clip-end` to frame a single
+  `accent-color`, `exclusive`, `playbackrates` — space-separated
+  playback-speed-menu rates, default `1 1.5 2`, shown at every player size
+  (sites embed v7) — and `clip-start`/`clip-end` to frame a single
   "back to moment" clip — `clip-only`, 0.3.8+, plays nothing but that
-  window) and a JS API (`playSegment`, `seekTo`, media
+  window) and a JS API (`playSegment`, `seekTo`, `playbackRate` get/set, media
   events re-dispatched on the element) for custom site HTML, and plays
   standalone or inside the container components (`<cg-playlist>`,
   `<cg-grid>`, `<cg-chapters>`) — see reference/verbs.md.
+- **Link preview** — the Open Graph card a platform (Slack, iMessage, Notion,
+  Discord) renders when someone pastes a site or share link. Public sites and
+  shares always preview: a public site's card comes from the `og:*` tags in
+  the HTML you generate, a public share's from its title/description/thumbnail.
+  Private sites and shares are redirected to sign-in before an unfurl bot sees
+  anything, so they render a bare "Sign in" card unless opted in with
+  `--link-preview full` (0.3.14+, feature `publish.link.preview.v1`; private
+  sites also take `--preview-title` / `--preview-image`). Opting in makes those
+  card fields publicly readable — content and playback stay sign-in gated — so
+  ask the user first. See reference/verbs.md.
 - **Discovery components (live API, 0.3.6+)** — the same embed script also
   defines four collection-scoped, **private-site-only** elements that let a
   viewer search or chat inside a published site and play results inline via

package/skills/tinycloud/reference/verbs.md CHANGED Viewed

@@ -319,7 +319,8 @@ tinycloud workflow <name> <source> [--param k=v] [--segment <s>] [--out <dir>]
 ```bash
 tinycloud publish <html-file-or-dir> [--name <site-name>]
-  [--visibility public|private] --json
+  [--visibility public|private]
+  [--link-preview none|full] [--preview-title <text>] [--preview-image <url>] --json
 tinycloud publish list --json                       # sites for this account, with URLs
 tinycloud publish unpublish <site-ref> --json       # site_id, site name, or the --name label
 ```
@@ -343,11 +344,49 @@ site itself gets a generated name (e.g. `young-fire-2486`) shown by
 `publish list`. `unpublish` resolves any of: the `site_id` UUID, the
 generated site name, or your `--name` label.
+**Link previews (0.3.14+, `publish.link.preview.v1`)** — how a pasted link
+unfurls in Slack, iMessage, Notion, Discord. The two visibilities work
+completely differently:
+- **Public site** — needs no flags. Its HTML reaches the unfurl bot verbatim,
+  so the card *is* whatever Open Graph tags the page carries. **Emit them in
+  the `<head>` of every public page you generate** — `og:title`,
+  `og:description`, `og:image` (an **absolute** URL — a share's `preview_url`
+  works), `og:url`, `twitter:card` — because a regenerated page without them
+  silently reverts the card to a bare link. Bots don't run JavaScript, so the
+  tags must be in the static HTML. Never emit `twitter:player` or `og:video`
+  (unfurlers ignore them for our domains and can degrade the card).
+- **Private site** — the edge gate redirects bots to sign-in before any HTML
+  is served, so OG tags in the page are never seen and the link unfurls as a
+  bare "Sign in" card. Opt in instead with `--link-preview full`, plus
+  `--preview-title` (falls back to the generated site name) and
+  `--preview-image` (**must be publicly fetchable** — site assets sit behind
+  the same gate the bot can't pass, so use a share's `preview_url`; prefer a
+  long-lived unsigned URL, since unfurl caches hold the exact URL). The card
+  description is the site description. Pass `""` to either flag to clear it.
+`--link-preview` is flippable on an **existing** site without republishing
+content: the run reports `action: "settings-only"` (a settings PATCH, no
+re-upload, no new version). The state comes back as `data.link_preview` (plus
+`data.preview_title` / `data.preview_image_url`) and shows in `publish list`
+rows as `link-preview=full`. `--preview-title`/`--preview-image` require
+`--link-preview full`, and a non-absolute `--preview-image` errors before any
+upload.
+⚠️ **Ask the user before opting a private site in.** `--link-preview full`
+makes the card title, the site description, and the card image readable by
+anyone who fetches the link — the user-agent check only *routes*; the setting
+is the security boundary. Nothing else leaks (no site content, video, tokens,
+or cookies; the site stays sign-in gated). Platforms cache per exact URL and
+rehost the image, so flipping back to `none` stops *future* unfurls but does
+not retract already-posted cards.
 ### publish video — share a video
 ```bash
 tinycloud publish video <source> [--visibility public|private]   # default public
-  [--name <title>] [--segment-id <id>] [--clip-start <s> --clip-end <e> [--clip-only]] --json
+  [--name <title>] [--segment-id <id>] [--clip-start <s> --clip-end <e> [--clip-only]]
+  [--link-preview none|full] --json
 tinycloud publish video list [--in <source>] [--visibility public|private] --json
 tinycloud publish video unpublish <share-id | source> --json   # --visibility disambiguates
 ```
@@ -385,18 +424,40 @@ feature id.
   `&clip=hard` and fall back to the soft window. It shapes the viewing
   experience, not access control — anyone with the bare `share_url` still has
   the whole video; restrict access with `--visibility private`.
+- Link previews (0.3.14+): a PUBLIC share page always unfurls in Slack with a
+  card built from its title, description, and thumbnail. A PRIVATE share is
+  redirected to sign-in before the bot sees anything, so it unfurls as a bare
+  "Sign in" card unless you pass `--link-preview full`, which serves bots a
+  metadata-only stub built from those same three fields. It comes back as
+  `data.share.link_preview`, and re-running flips it on an existing share
+  (a PATCH — no new share). Playback stays sign-in gated in every mode.
+  ⚠️ Ask the user first: `full` makes the share's title, description, and
+  thumbnail readable by anyone who fetches the link, and platforms cache per
+  exact URL, so turning it back off does not retract already-posted cards.
 When generating custom site HTML around a `<cg-video>` embed, use the
 component's built-ins instead of reinventing them. It defaults to a
 responsive 16:9 dark placeholder (override with plain page CSS on the
 `cg-video` selector); mount-time attributes: `autoplay` (pair with `muted` or
-browsers block it), `loop`, `start-time`, `poster`, `accent-color`, and
+browsers block it), `loop`, `start-time`, `poster`, `accent-color`,
+`playbackrates` (speed menu — next paragraph), and
 `exclusive` (put it on every player in a gallery so starting one pauses the
 rest). Its JS API queues until ready — `playSegment(start, end?)`,
-`seekTo()`, `play()`/`pause()` — and media events are re-dispatched on the
+`seekTo()`, `play()`/`pause()`, `playbackRate` (get/set) — and media events
+are re-dispatched on the
 element (`timeupdate`, `ended`, `cg-ready`); prefer `playSegment` over
 hand-rolled seek logic for "click a moment to play that segment" pages.
+Playback speed (sites embed v7): every `<cg-video>` shows a playback-speed
+menu at every player size — including narrow grid cells and phones — with
+default rates `1 1.5 2`. Supply your own list with the space-separated
+`playbackrates` attribute (e.g. `playbackrates="0.5 1 1.5 2"`), and get/set
+the speed from page code via the `playbackRate` JS property (safe to set
+before mount; non-positive and non-numeric values are ignored — the viewer
+can always change it from the menu). The speed menu ships in the
+Cloudglue-served embed script, so it is not gated on a tinycloud version and
+already-published sites pick it up without republishing.
 To frame a single moment inside the full recording — a cited highlight you
 want to share on its own — add `clip-start`/`clip-end` (seconds) to a bare
 `<cg-video>`: the player draws a clip-length badge, a clip-region strip with a

package/skills/tinycloud/scripts/preflight.sh CHANGED Viewed

@@ -9,11 +9,11 @@ set -u
 # Mirror tinycloud-skill.json: min_version / supported_range upper bound
 # (CI diffs these against the manifest).
-MIN_VERSION="0.3.12"
+MIN_VERSION="0.3.14"
 MAX_VERSION_EXCLUSIVE="0.4.0"
 INSTALL_CMD='curl -fsSL https://app.cloudglue.dev/tinycloud.sh | bash'
 # Kept in sync with ../tinycloud-skill.json required_features (CI diffs them).
-REQUIRED_FEATURES="envelope.v1 watch.v1 watch.speech.v1 see.v1 extract.v1 extract.images.v1 caption.v1 search.v1 probe.v1 ask.v1 clip.v1 grab.v1 face.v1 jobs.v1 library.collections.v1 library.collections.create.v1 library.collections.mutate.v1 library.collections.entities.v1 library.sync.url.v1 workflow.v1 publish.v1 publish.manage.v1 publish.video.v1 setup.v1"
+REQUIRED_FEATURES="envelope.v1 watch.v1 watch.speech.v1 see.v1 extract.v1 extract.images.v1 caption.v1 search.v1 probe.v1 ask.v1 clip.v1 grab.v1 face.v1 jobs.v1 library.collections.v1 library.collections.create.v1 library.collections.mutate.v1 library.collections.entities.v1 library.sync.url.v1 workflow.v1 publish.v1 publish.manage.v1 publish.video.v1 publish.link.preview.v1 setup.v1"
 # 1) Binary present and responsive?
 if ! command -v tinycloud >/dev/null 2>&1; then

package/skills/tinycloud/tinycloud-skill.json CHANGED Viewed

@@ -1,8 +1,8 @@
 {
-  "skill_version": "0.3.12",
+  "skill_version": "0.3.14",
   "tinycloud": {
-    "min_version": "0.3.12",
-    "supported_range": ">=0.3.12 <0.4.0",
+    "min_version": "0.3.14",
+    "supported_range": ">=0.3.14 <0.4.0",
     "required_features": [
       "envelope.v1",
       "watch.v1",
@@ -27,6 +27,7 @@
       "publish.v1",
       "publish.manage.v1",
       "publish.video.v1",
+      "publish.link.preview.v1",
       "setup.v1"
     ],
     "envelope_schema": "1",