@telepath-computer/television 0.1.162 → 0.1.164

package/dist/cli.cjs

@@ -52613,8 +52613,8 @@ function resolveVercelSkillsInstallerBin() {
   return localRequire.resolve("skills/bin/cli.mjs");
 }
 function readCLIVersion() {
-  if ("0.1.162".length > 0) {
-    return "0.1.162";
+  if ("0.1.164".length > 0) {
+    return "0.1.164";
   }
   const devPackageJsonPath = import_node_path12.default.join(getDevPackageDir(), "package.json");
   if (!(0, import_node_fs10.existsSync)(devPackageJsonPath)) {

package/dist/skills/television/SKILL.md

@@ -444,6 +444,8 @@ To share a path artifact from one Television server to another, build a producer
 http://<producer-host>:<port>/artifact/<artifact-id>/<basename>
 ```
 
+**CRITICAL — the share URL carries NO token.** Do not append the server's main `tv` bearer token (or any `?token=`/`Authorization` value) to a share URL, and never include it when telling the recipient how to reach the artifact. The `/artifact/<id>/*` proxy is bearerless: the unguessable artifact id in the path *is* the capability. The recipient is authorized by holding the artifact-id URL, not by holding the producer's main token. Leaking the main token would hand over full read/write control of the entire producer server; the artifact id only grants read access to that one artifact's rendered content. A correct share URL is exactly the form above — host, port, `/artifact/<artifact-id>/`, basename — and nothing else.
+
 First run `tv status` on the producer. Its JSON reports the server `bindAddresses` and `port`. Choose the host that the recipient can actually reach:
 
 - Prefer a Tailscale CGNAT address (`100.64.0.0/10`) when one is present.
@@ -454,7 +456,7 @@ First run `tv status` on the producer. Its JSON reports the server `bindAddresse
 
 For directory artifacts, use the directory proxy URL ending in `/artifact/<artifact-id>/`. For file artifacts, include the encoded basename. The recipient adds that URL with `tv create-url-artifact`; Television recognizes the `/artifact/<id>/...` shape, renders it inline, and reloads it from the producer when the producer content changes.
 
-Markdown artifacts shared this way render as read-only HTML. Anyone with the artifact proxy URL can read the rendered artifact content, matching the HTML artifact capability model.
+Markdown artifacts shared this way render as read-only HTML. Anyone with the artifact proxy URL can read the rendered artifact content, matching the HTML artifact capability model — and that read works with no token at all, because the artifact id alone authorizes the read.
 
 There is no separate `share-artifact` command. To "share" a URL artifact, pass along the underlying URL and let the recipient create their own URL artifact.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telepath-computer/television",
-  "version": "0.1.162",
+  "version": "0.1.164",
   "type": "module",
   "main": "dist/cli.cjs",
   "bin": {