@cloudglue/tinycloud 0.3.13 → 0.3.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +2 -2
  2. package/package.json +1 -1
  3. package/skills/tinycloud/SKILL.md +13 -0
  4. package/skills/tinycloud/reference/glossary.md +10 -0
  5. package/skills/tinycloud/reference/verbs.md +51 -2
  6. package/skills/tinycloud/scripts/preflight.sh +2 -2
  7. package/skills/tinycloud/tinycloud-skill.json +4 -3
package/README.md CHANGED
@@ -17,11 +17,11 @@ The npm package is a small launcher: on first run it downloads the matching
17
17
  platform distribution from Cloudglue's CDN (cached under
18
18
  `~/.tinycloud/versions/<version>/`), verifies its checksum, and execs the real
19
19
  binary. The package version pins the binary version, so
20
- `npx @cloudglue/tinycloud@0.3.13` always runs tinycloud 0.3.13. It also adds two
20
+ `npx @cloudglue/tinycloud@0.3.14` always runs tinycloud 0.3.14. It also adds two
21
21
  wrapper commands:
22
22
 
23
23
  ```bash
24
- tinycloud install --version 0.3.13 # pre-download a version
24
+ tinycloud install --version 0.3.14 # pre-download a version
25
25
  tinycloud install --latest # install latest stable and pin to it
26
26
  tinycloud update # move to latest stable, prune old versions
27
27
  ```
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cloudglue/tinycloud",
3
- "version": "0.3.13",
3
+ "version": "0.3.14",
4
4
  "description": "Agent CLI for deep video and image work, by Cloudglue. Downloads the tinycloud binary on first run.",
5
5
  "bin": {
6
6
  "tinycloud": "bin/tinycloud.js"
package/skills/tinycloud/SKILL.md CHANGED
@@ -214,6 +214,19 @@ Authoring your own recipes: [reference/workflow-authoring.md](reference/workflow
214
214
  (`<cg-playlist>`, `<cg-grid>`, `<cg-chapters>`) rather than hand-rolled
215
215
  players, galleries, or segment-list JS — details in
216
216
  [reference/verbs.md](reference/verbs.md).
217
+ - Link previews (0.3.14+): how a pasted link unfurls in Slack/iMessage/Notion.
218
+ A **public** site's card comes from the HTML you generate — put `og:title`,
219
+ `og:description`, `og:image` (absolute URL — a share's `preview_url` works),
220
+ `og:url`, and `twitter:card` in the `<head>` of every public page, or the
221
+ link renders as a bare URL (bots don't run JS; never emit
222
+ `twitter:player`/`og:video`). A **private** site or share never reaches the
223
+ bot, so its card is off by default — opt in with `--link-preview full`
224
+ (private sites also take `--preview-title` / `--preview-image`; a private
225
+ share reuses its own title, description, and thumbnail). ⚠️ Ask the user
226
+ before turning it on: it makes those card fields readable by anyone with the
227
+ link (content and playback stay sign-in gated), and platforms cache per exact
228
+ URL, so turning it back off does not retract posted cards. Details in
229
+ [reference/verbs.md](reference/verbs.md).
217
230
  - Live-API discovery components (0.3.6+): the same embed script also defines
218
231
  collection-scoped, **private-site-only** elements that let viewers search/chat
219
232
  inside a published site — `<cg-chat>`, `<cg-search>`, `<cg-deep-search>`,
package/skills/tinycloud/reference/glossary.md CHANGED
@@ -130,6 +130,16 @@ connector?" or an envelope field needs explaining.
130
130
  events re-dispatched on the element) for custom site HTML, and plays
131
131
  standalone or inside the container components (`<cg-playlist>`,
132
132
  `<cg-grid>`, `<cg-chapters>`) — see reference/verbs.md.
133
+ - **Link preview** — the Open Graph card a platform (Slack, iMessage, Notion,
134
+ Discord) renders when someone pastes a site or share link. Public sites and
135
+ shares always preview: a public site's card comes from the `og:*` tags in
136
+ the HTML you generate, a public share's from its title/description/thumbnail.
137
+ Private sites and shares are redirected to sign-in before an unfurl bot sees
138
+ anything, so they render a bare "Sign in" card unless opted in with
139
+ `--link-preview full` (0.3.14+, feature `publish.link.preview.v1`; private
140
+ sites also take `--preview-title` / `--preview-image`). Opting in makes those
141
+ card fields publicly readable — content and playback stay sign-in gated — so
142
+ ask the user first. See reference/verbs.md.
133
143
  - **Discovery components (live API, 0.3.6+)** — the same embed script also
134
144
  defines four collection-scoped, **private-site-only** elements that let a
135
145
  viewer search or chat inside a published site and play results inline via
package/skills/tinycloud/reference/verbs.md CHANGED
@@ -319,7 +319,8 @@ tinycloud workflow <name> <source> [--param k=v] [--segment <s>] [--out <dir>]
319
319
 
320
320
  ```bash
321
321
  tinycloud publish <html-file-or-dir> [--name <site-name>]
322
- [--visibility public|private] --json
322
+ [--visibility public|private]
323
+ [--link-preview none|full] [--preview-title <text>] [--preview-image <url>] --json
323
324
  tinycloud publish list --json # sites for this account, with URLs
324
325
  tinycloud publish unpublish <site-ref> --json # site_id, site name, or the --name label
325
326
  ```
@@ -343,11 +344,49 @@ site itself gets a generated name (e.g. `young-fire-2486`) shown by
343
344
  `publish list`. `unpublish` resolves any of: the `site_id` UUID, the
344
345
  generated site name, or your `--name` label.
345
346
 
347
+ **Link previews (0.3.14+, `publish.link.preview.v1`)** — how a pasted link
348
+ unfurls in Slack, iMessage, Notion, Discord. The two visibilities work
349
+ completely differently:
350
+
351
+ - **Public site** — needs no flags. Its HTML reaches the unfurl bot verbatim,
352
+ so the card *is* whatever Open Graph tags the page carries. **Emit them in
353
+ the `<head>` of every public page you generate** — `og:title`,
354
+ `og:description`, `og:image` (an **absolute** URL — a share's `preview_url`
355
+ works), `og:url`, `twitter:card` — because a regenerated page without them
356
+ silently reverts the card to a bare link. Bots don't run JavaScript, so the
357
+ tags must be in the static HTML. Never emit `twitter:player` or `og:video`
358
+ (unfurlers ignore them for our domains and can degrade the card).
359
+ - **Private site** — the edge gate redirects bots to sign-in before any HTML
360
+ is served, so OG tags in the page are never seen and the link unfurls as a
361
+ bare "Sign in" card. Opt in instead with `--link-preview full`, plus
362
+ `--preview-title` (falls back to the generated site name) and
363
+ `--preview-image` (**must be publicly fetchable** — site assets sit behind
364
+ the same gate the bot can't pass, so use a share's `preview_url`; prefer a
365
+ long-lived unsigned URL, since unfurl caches hold the exact URL). The card
366
+ description is the site description. Pass `""` to either flag to clear it.
367
+
368
+ `--link-preview` is flippable on an **existing** site without republishing
369
+ content: the run reports `action: "settings-only"` (a settings PATCH, no
370
+ re-upload, no new version). The state comes back as `data.link_preview` (plus
371
+ `data.preview_title` / `data.preview_image_url`) and shows in `publish list`
372
+ rows as `link-preview=full`. `--preview-title`/`--preview-image` require
373
+ `--link-preview full`, and a non-absolute `--preview-image` errors before any
374
+ upload.
375
+
376
+ ⚠️ **Ask the user before opting a private site in.** `--link-preview full`
377
+ makes the card title, the site description, and the card image readable by
378
+ anyone who fetches the link — the user-agent check only *routes*; the setting
379
+ is the security boundary. Nothing else leaks (no site content, video, tokens,
380
+ or cookies; the site stays sign-in gated). Platforms cache per exact URL and
381
+ rehost the image, so flipping back to `none` stops *future* unfurls but does
382
+ not retract already-posted cards.
383
+
346
384
  ### publish video — share a video
347
385
 
348
386
  ```bash
349
387
  tinycloud publish video <source> [--visibility public|private] # default public
350
- [--name <title>] [--segment-id <id>] [--clip-start <s> --clip-end <e> [--clip-only]] --json
388
+ [--name <title>] [--segment-id <id>] [--clip-start <s> --clip-end <e> [--clip-only]]
389
+ [--link-preview none|full] --json
351
390
  tinycloud publish video list [--in <source>] [--visibility public|private] --json
352
391
  tinycloud publish video unpublish <share-id | source> --json # --visibility disambiguates
353
392
  ```
@@ -385,6 +424,16 @@ feature id.
385
424
  `&clip=hard` and fall back to the soft window. It shapes the viewing
386
425
  experience, not access control — anyone with the bare `share_url` still has
387
426
  the whole video; restrict access with `--visibility private`.
427
+ - Link previews (0.3.14+): a PUBLIC share page always unfurls in Slack with a
428
+ card built from its title, description, and thumbnail. A PRIVATE share is
429
+ redirected to sign-in before the bot sees anything, so it unfurls as a bare
430
+ "Sign in" card unless you pass `--link-preview full`, which serves bots a
431
+ metadata-only stub built from those same three fields. It comes back as
432
+ `data.share.link_preview`, and re-running flips it on an existing share
433
+ (a PATCH — no new share). Playback stays sign-in gated in every mode.
434
+ ⚠️ Ask the user first: `full` makes the share's title, description, and
435
+ thumbnail readable by anyone who fetches the link, and platforms cache per
436
+ exact URL, so turning it back off does not retract already-posted cards.
388
437
 
389
438
  When generating custom site HTML around a `<cg-video>` embed, use the
390
439
  component's built-ins instead of reinventing them. It defaults to a
package/skills/tinycloud/scripts/preflight.sh CHANGED
@@ -9,11 +9,11 @@ set -u
9
9
 
10
10
  # Mirror tinycloud-skill.json: min_version / supported_range upper bound
11
11
  # (CI diffs these against the manifest).
12
- MIN_VERSION="0.3.12"
12
+ MIN_VERSION="0.3.14"
13
13
  MAX_VERSION_EXCLUSIVE="0.4.0"
14
14
  INSTALL_CMD='curl -fsSL https://app.cloudglue.dev/tinycloud.sh | bash'
15
15
  # Kept in sync with ../tinycloud-skill.json required_features (CI diffs them).
16
- REQUIRED_FEATURES="envelope.v1 watch.v1 watch.speech.v1 see.v1 extract.v1 extract.images.v1 caption.v1 search.v1 probe.v1 ask.v1 clip.v1 grab.v1 face.v1 jobs.v1 library.collections.v1 library.collections.create.v1 library.collections.mutate.v1 library.collections.entities.v1 library.sync.url.v1 workflow.v1 publish.v1 publish.manage.v1 publish.video.v1 setup.v1"
16
+ REQUIRED_FEATURES="envelope.v1 watch.v1 watch.speech.v1 see.v1 extract.v1 extract.images.v1 caption.v1 search.v1 probe.v1 ask.v1 clip.v1 grab.v1 face.v1 jobs.v1 library.collections.v1 library.collections.create.v1 library.collections.mutate.v1 library.collections.entities.v1 library.sync.url.v1 workflow.v1 publish.v1 publish.manage.v1 publish.video.v1 publish.link.preview.v1 setup.v1"
17
17
 
18
18
  # 1) Binary present and responsive?
19
19
  if ! command -v tinycloud >/dev/null 2>&1; then
package/skills/tinycloud/tinycloud-skill.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
- "skill_version": "0.3.13",
2
+ "skill_version": "0.3.14",
3
3
  "tinycloud": {
4
- "min_version": "0.3.12",
5
- "supported_range": ">=0.3.12 <0.4.0",
4
+ "min_version": "0.3.14",
5
+ "supported_range": ">=0.3.14 <0.4.0",
6
6
  "required_features": [
7
7
  "envelope.v1",
8
8
  "watch.v1",
@@ -27,6 +27,7 @@
27
27
  "publish.v1",
28
28
  "publish.manage.v1",
29
29
  "publish.video.v1",
30
+ "publish.link.preview.v1",
30
31
  "setup.v1"
31
32
  ],
32
33
  "envelope_schema": "1",