@mindstudio-ai/remy 0.1.336 → 0.1.338

package/dist/prompt/compiled/sdk-actions.md

@@ -22,6 +22,20 @@ result.content;              // step-specific output
 result.$billingCost;         // cost in credits (if applicable)
 ```
 
+## Where files an action produces end up
+
+Any action that returns a file URL writes to the shared **public** MindStudio CDN by default: unlisted, but readable by anyone holding the URL, and it never expires. Pass a file store as `store` in the options object to write into the app's own storage instead — a private store means the URL only loads for an authorized app session.
+
+```typescript
+const Reports = files.defineStore('reports', { access: 'private' });
+
+const { imageUrl } = await mindstudio.generateImage({ prompt }, { store: Reports });
+```
+
+**Use a store whenever the file belongs to a specific user or is confidential** (a client document, a participant recording, anything the app wouldn't publish). The public default is for marketing images and other genuinely world-readable assets. See the `files` skill.
+
+Inputs are safe either way: a private file or a `shareUrl` handed to an action is read where it sits, and any intermediate the platform needs (transcoding a video, rasterizing a PDF) is staged privately and deleted when the call finishes.
+
 ## Available Actions
 
 ### AI Generation

package/dist/prompt/skills/files.md

@@ -114,13 +114,15 @@ remy-admin files rm --store handoff --key <key> --private               # revoke
 
 ## Generated assets
 
-MindStudio SDK Actions that produce a file (`generateImage`, `generateVideo`, `generateSpeech`, `generatePdf`, `upscaleImage`, …) can optionally write straight into a store — pass the handle as `store` in the options object:
+Every MindStudio SDK Action that produces a file (`generateImage`, `generateVideo`, `generateSpeech`, `generatePdf`, `upscaleImage`, `trimMedia`, `convertPdfToImages`, `screenshotUrl`, `getGmailAttachments`, …) can write straight into a store — pass the handle as `store` in the options object:
 
 ```typescript
 const { imageUrl } = await mindstudio.generateImage({ prompt }, { store: Assets });
 ```
 
-If omitted, files are written to the default global, public MindStudio CDN.
+If omitted, the file goes to the shared public MindStudio CDN, where the URL is unlisted but readable by anyone who has it, forever. **For anything confidential, pass a private store.** That's the one thing to get right here — the default is fine for marketing images and wrong for client material.
+
+**Actions never publish what you give them.** An input that's already one of the app's own files — a private object, a `shareUrl` link, a `/_/files/...` path — is read where it sits, and anything the platform has to convert first (a non-mp4 video, the pages of a PDF, a document an extraction model must fetch) is staged privately and discarded when the call finishes. So handing `extractText` a private contract, or `trimMedia` a private `.mov`, leaves no public copy behind.
 
 ## When public vs private
 

package/dist/prompt/static/coding.md

@@ -82,8 +82,8 @@ You have access to the `mindstudio` CLI, which exposes every SDK action as a com
 ### Production App Management
 You have access to `remy-admin`, a CLI for managing the user's production app. Use it via your bash tool. All output is JSON. Run `remy-admin --help` or `remy-admin <command> --help` to discover usage and available options.
 
-Available commands: `requests` (server logs, errors, latency), `crashes` (frontend browser errors), `analytics` (traffic queries — lifetime metrics, sources, live counters), `releases`, `diagnostics` (Lighthouse audit), `domains`, `users` (list, set roles), `db` (query production sql), `data` (live db operations like lift-from-dev), `methods` (list, invoke), `secrets`, `files` (CDN files), `datasources` (document corpora: add, search, `inspect` a bucket or store, bulk `jobs` with a plan, S3 `connect`/`sync`, mappers via `map test`/`remap`, `eval`), `infra` (dedicated retrieval capacity for large corpora), `prerender` (crawler snapshots), `voice` (phone numbers, call logs, voice policy), `issues` (externally-reported bugs), `settings` (app settings: signup restrictions, app-store-reviewer test accounts, embedding origins, toggles).
+Available commands: `requests` (server logs, errors, latency), `crashes` (frontend browser errors), `analytics` (traffic queries — lifetime metrics, sources, live counters), `releases`, `diagnostics` (Lighthouse audit), `domains`, `users` (list, set roles), `db` (query production sql), `data` (live db operations like lift-from-dev), `methods` (list, invoke), `secrets`, `files` (CDN files), `datasources` (document corpora: add, search, `inspect` a bucket or store, bulk `jobs` with a plan, S3 `connect`/`sync`, mappers via `map test`/`remap`, `eval`), `infra` (dedicated retrieval capacity for large corpora), `prerender` (crawler snapshots), `voice` (phone numbers, call logs, voice policy), `issues` (the app's issue tracker: bugs its own users reported, and requests other apps in the workspace filed; `--app` reads or files into another app's tracker), `settings` (app settings: signup restrictions, app-store-reviewer test accounts, embedding origins, toggles).
 
-Two rules: buying a `voice` phone number bills $1/month — never buy without the user's explicit confirmation. `issues` is for externally-reported bugs only — read from it and resolve items when the user asks; never use it to track work you are doing with the user.
+Two rules: buying a `voice` phone number bills $1/month — never buy without the user's explicit confirmation. `issues` is inbound from other people, not your scratchpad: never file your own work-in-progress there, and never use it to track what you and the user are part-way through. Do act on what arrives — a bug an end-user reported, or a request another app filed — and reply on the thread rather than only in chat, because the app that filed it reads your comments and has no other way to hear back.
 
 Use when the user asks about production behavior (server errors via `requests`, browser crashes via `crashes`, traffic/engagement via `analytics`), wants to manage their live app (domains, users, roles), needs to seed or query production data, or wants to check release status.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindstudio-ai/remy",
-  "version": "0.1.336",
+  "version": "0.1.338",
   "description": "Remy coding agent",
   "repository": {
     "type": "git",