mdpush 1.0.0 → 1.1.1

package/README.md

@@ -1,6 +1,6 @@
 # mdpush
 
-Push markdown files to [Preview Reader](https://github.com/sielay/preview-reader) from your terminal.
+Push markdown files to [sielay](https://github.com/emiliovos/sielay) from your terminal.
 
 ## Install
 
@@ -35,18 +35,33 @@ Interactive wizard to configure server, token, and default project. Validates yo
 
 ### `mdpush push [files...]`
 
-Upload `.md` and `.txt` files to a project.
+Upload `.md`, `.txt`, and `.html` files to a project. HTML files are hosted at `/v/:sid` as sandboxed artifacts with an optional `--type` tag.
 
 | Flag | Description |
 |------|-------------|
 | `-p, --project <slug>` | Target project (falls back to default from setup) |
-| `-f, --folder <path>` | Subfolder within the project |
+| `-f, --folder <path>` | Subfolder within the project (md/txt only — HTML artifacts are flat) |
+| `-t, --type <value>` | HTML artifact type: `spec` \| `review` \| `design` \| `report` \| `playground` (HTML files only) |
 
 ```bash
-mdpush push README.md                        # Uses default project
-mdpush push -p docs-site *.md                # Specific project
-mdpush push -p docs-site -f guides plan.md   # Into subfolder
-mdpush push docs/                            # Upload entire directory
+mdpush push README.md                              # Uses default project
+mdpush push -p docs-site *.md                      # Specific project
+mdpush push -p docs-site -f guides plan.md         # Into subfolder
+mdpush push docs/                                  # Upload entire directory (md/txt only)
+mdpush push design.html --type design              # HTML artifact with type tag
+mdpush push spec.html notes.md --type spec         # Mixed batch — type applies only to .html
+```
+
+HTML output includes the viewer URL and type badge:
+
+```
+🔗 [design] https://docs.example.com/v/abc123  design.html
+```
+
+`.md`/`.txt` output uses the project-relative direct link:
+
+```
+🔗 https://docs.example.com/p/docs-site/f/xyz789  plan.md
 ```
 
 ### `mdpush login`
@@ -102,12 +117,13 @@ Generate tokens from the web UI: **Sidebar > API Tokens > Generate Token**.
 | `401 Unauthorized` | Token expired or revoked. Generate a new one from the web UI. |
 | `403 Forbidden` | No write access to this project. Ask the owner to invite you. |
 | `404 Not Found` | Wrong project slug. Check it in the web UI URL: `/p/<slug>` |
-| `413 Too Large` | File exceeds 5MB limit. |
+| `413 Too Large` | File exceeds 10MB (.md/.txt) or 15MB (.html) limit. |
+| `400 Invalid type` | `--type` value not in whitelist. Use one of: `spec`, `review`, `design`, `report`, `playground`. |
 
 ## Requirements
 
 - Node.js >= 18
-- A running [Preview Reader](https://github.com/sielay/preview-reader) server
+- A running [sielay](https://github.com/emiliovos/sielay) server
 
 ## License
 

package/assets/SKILL.md

@@ -1,20 +1,30 @@
 ---
 name: mdpush
-description: Push markdown files to Preview Reader server. Use when user wants to upload .md/.txt files to their docs portal.
+description: Push markdown, text, and HTML artifact files to Preview Reader / sielay server. Use when user wants to upload .md/.txt files to their docs portal OR when user wants to host/share a self-contained HTML artifact (spec, review, design, report, playground).
 ---
 
-# mdpush — Push Markdown to Preview Reader
+# mdpush — Push Markdown and HTML Artifacts to Preview Reader
 
-Push `.md` and `.txt` files from the current project to a Preview Reader server.
+Push `.md`, `.txt`, and `.html` files from the current project to a Preview Reader server. HTML files are hosted at `/v/:sid` as sandboxed artifacts with an optional type tag.
 
 ## Usage
 
 ```
-/mdpush <files...>                    # Push to default project
-/mdpush -p <project-slug> <files...>  # Push to specific project
-/mdpush -f <folder> <files...>        # Push to subfolder within project
+/mdpush <files...>                                 # Push to default project
+/mdpush -p <project-slug> <files...>               # Push to specific project
+/mdpush -f <folder> <files...>                     # Push to subfolder within project (md/txt only)
+/mdpush design.html --type design                  # Upload HTML artifact with type tag
+/mdpush spec.html report.md --type spec            # Mix: HTML gets type, .md does not
 ```
 
+### `--type` flag (HTML only)
+
+Valid values: `spec | review | design | report | playground`
+
+- Only meaningful for `.html` files — silently ignored for `.md`/`.txt`
+- Rejected client-side before any network call if value is outside whitelist (exit 2)
+- Output includes badge when type provided: `OK: design.html [design] → https://docs.sielay.cloud/v/abc123`
+
 ## Setup
 
 Requires `~/.mdpush.json` config file:
@@ -39,6 +49,93 @@ Run the push script:
 bash ~/.claude/skills/mdpush/scripts/push.sh [flags] <files...>
 ```
 
-Flags: `-p <project>` (override project), `-f <folder>` (subfolder target).
+Flags: `-p <project>` (override project), `-f <folder>` (subfolder, md/txt only), `--type <value>` (HTML artifact taxonomy).
 
 Report the script output to the user. If config is missing, show the setup instructions above.
+
+## HTML Quality Recommendations
+
+Before generating an HTML artifact for upload, activate these skills to produce polished, non-generic output:
+
+| Goal | Skill | When to use |
+|---|---|---|
+| Dashboard, monitoring UI, data-rich layouts | `frontend-design` | Cards, sparklines, status pills, responsive grid |
+| Landing page, admin panel, interactive UI | `ui-ux-pro-max` | 50+ styles, 21 palettes, 50 font pairings |
+| Brand-consistent tokens, style guide, design system | `design` | Ensure visual consistency across artifacts |
+
+**Recommended workflow:**
+
+```
+# Polished dashboard artifact
+/frontend-design "Monitoring dashboard with cards, sparklines, status pills"
+# → output: design.html
+
+/mdpush design.html --type design
+# → OK: design.html [design] → https://docs.sielay.cloud/v/abc123
+```
+
+```
+# Interactive playground (sliders, live preview, copy-to-clipboard)
+/ui-ux-pro-max "Easing curve tuner with sliders + animation preview + copy CSS output"
+# → output: playground.html
+
+/mdpush playground.html --type playground
+```
+
+Context source: [HTML Effectiveness — Thariq](https://thariqs.github.io/html-effectiveness/) — taxonomy and patterns that inform the `--type` whitelist and quality bar for artifacts.
+
+## Sandbox Limitations
+
+HTML artifacts run inside an `<iframe>` with a restrictive sandbox (`sandbox="allow-scripts allow-forms allow-modals"` — **no** `allow-same-origin`). This gives the document a `null` origin. The following APIs are affected:
+
+| API | Behavior inside sandbox | Workaround |
+|---|---|---|
+| `localStorage` / `sessionStorage` | Throws `SecurityError` | Use in-memory state (plain JS variables/objects) |
+| `document.cookie` | Returns empty string, writes silently ignored | Use in-memory state |
+| `fetch()` cross-origin | Blocked by CSP — request never leaves browser | Inline all data; no runtime API calls |
+| `fetch()` same-origin | Also blocked (null origin has no same-origin) | Inline all data |
+| Clipboard write (`navigator.clipboard.writeText`) | Works with user gesture | Fine as-is |
+| Form submit | Works (sandbox allows forms) | Fine as-is |
+| DOM events, timers, animations | All work normally | Fine as-is |
+| ES modules (`type="module"`) | Work — null origin does not block modules | Fine as-is |
+
+**Artifact-author contract:**
+- Self-contained HTML — all CSS and JS must be inlined or in `<style>`/`<script>` tags
+- No external asset loads (CDN fonts, external images) — inline or omit
+- File size < 15MB enforced server-side (HTTP 413 returned if exceeded)
+- No cookies, no localStorage — design state to live only in memory for the session
+
+## Future: `--inline-all` mode (not yet implemented)
+
+Strict self-containment mode for compliance, airgap, or long-term archive scenarios. Pre-processes the HTML client-side **before upload**: compiles detected Tailwind utility classes into a static `<style>` block via Tailwind CLI, fetches Google Fonts / Fontshare CSS plus each `.woff2` and base64-inlines them as `data:font/woff2;base64,...`, and optionally inlines whitelisted CDN scripts. The resulting artifact has zero external network dependencies — survives any future CDN outage, CSP tightening, or sandbox change.
+
+### Trade-offs
+
+| Dimension | Current (CSP whitelist, shipped) | `--inline-all` (proposed) |
+|---|---|---|
+| Author overhead | 0s — author writes normal HTML with CDN refs | 3–7s warm preprocess; 30–60s cold (Tailwind CLI install) |
+| Artifact size | 30KB typical | 400–700KB typical (10–30x growth) |
+| CDN dependency | Depends on 9-host whitelist staying available | Zero — fully self-contained |
+| Server bandwidth | Low — artifacts stay small, browser fetches CDN | Higher — every artifact ships fonts/CSS in payload |
+| Implementation effort | 0 (done) | ~1.5d (Tailwind detection + binary inlining + size-cap guard) |
+
+### When to opt in
+
+- **Compliance audits** — auditor needs to inspect the exact bytes that render
+- **Airgap deployments** — environment has no internet egress, CDN unreachable
+- **Long-term archive** — artifact must render identically in 5+ years regardless of CDN survival
+- **Untrusted preview environments** — avoid even the metadata leak of CDN requests
+
+### Activation surface (when implemented)
+
+Two viable shapes — decide at implementation time:
+
+1. **Strict opt-in flag**: `mdpush artifact.html --inline-all` — author explicit, default stays fast
+2. **Smart auto-detect**: if HTML contains external `<link>`/`<script>` refs, auto-inline; opt out via `--no-inline`. Pro: no compliance footgun. Con: opaque size growth.
+
+### Why not default now
+
+Phase 1 CSP whitelist covers ~95% of artifacts that current Claude/agent workflows generate, with 0s author overhead. The 5–30x size penalty of full inlining is wasted bandwidth for the typical case. Document as roadmap; ship only when compliance or airgap demand surfaces.
+
+**Reference**: `plans/260512-1704-html-fidelity-render-as-original/plan.md` — Option D row in the trade-off table that informed this deferral decision.
+

package/assets/scripts/push.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
-# mdpush — push .md/.txt files to Preview Reader via API
+# mdpush — push .md/.txt/.html files to Preview Reader via API
 # Reads config from ~/.mdpush.json (server, token, defaultProject)
+# Returns direct file links for each uploaded file
+# HTML files upload to /v/:sid endpoint; .md/.txt to /p/:project/f/:sid
 set -euo pipefail
 
 CONFIG="$HOME/.mdpush.json"
@@ -33,13 +35,31 @@ fi
 # Parse CLI args
 PROJECT="${DEFAULT_PROJECT:-}"
 FOLDER=""
+TYPE=""
 FILES=()
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
     -p) PROJECT="$2"; shift 2 ;;
     -f) FOLDER="$2"; shift 2 ;;
-    *)  FILES+=("$1"); shift ;;
+    --type)
+      if [[ $# -lt 2 ]]; then
+        echo "ERROR: --type requires a value" >&2
+        exit 2
+      fi
+      TYPE="$2"
+      # Strict client-side whitelist — reject before any network call
+      case "$TYPE" in
+        spec|review|design|report|playground) ;;
+        *)
+          echo "ERROR: --type must be one of: spec|review|design|report|playground" >&2
+          echo "       Got: $TYPE" >&2
+          exit 2
+          ;;
+      esac
+      shift 2
+      ;;
+    *) FILES+=("$1"); shift ;;
   esac
 done
 
@@ -50,22 +70,110 @@ fi
 
 if [ ${#FILES[@]} -eq 0 ]; then
   echo "ERROR: No files specified"
-  echo "Usage: push.sh [-p project] [-f folder] <files...>"
+  echo "Usage: push.sh [-p project] [-f folder] [--type spec|review|design|report|playground] <files...>"
   exit 1
 fi
 
-# Build query string for folder
-QUERY=""
+# Build folder query param (shared across non-HTML uploads)
+FOLDER_QUERY=""
 if [ -n "$FOLDER" ]; then
   ENCODED_FOLDER=$(python3 -c "import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))" "$FOLDER")
-  QUERY="?folder=$ENCODED_FOLDER"
+  FOLDER_QUERY="?folder=$ENCODED_FOLDER"
 fi
 
+# Extract server error message from JSON response body (best-effort)
+extract_server_message() {
+  local body="$1"
+  local msg=""
+  if command -v jq &>/dev/null; then
+    msg=$(echo "$body" | jq -r '.message // .error // empty' 2>/dev/null || true)
+  else
+    msg=$(python3 -c "import sys,json; d=json.loads(sys.argv[1]); print(d.get('message',d.get('error','')))" "$body" 2>/dev/null || true)
+  fi
+  echo "$msg"
+}
+
+# Millisecond-precision timestamp — bash 5+ date supports %3N;
+# macOS with BSD date does NOT support %3N: fall back to python3.
+_now_ms() {
+  local ms
+  ms=$(date +%s%3N 2>/dev/null)
+  # Detect failed %3N expansion: BSD date returns literal "%3N" suffix
+  if [[ "$ms" == *%3N* ]]; then
+    ms=$(python3 -c "import time; print(int(time.time()*1000))")
+  fi
+  echo "$ms"
+}
+
+# JSONL metrics log — created chmod 600 on first write
+METRICS_FILE="$HOME/.mdpush-metrics.jsonl"
+
+# Append one validated JSONL line to metrics file
+# Args: ts file ext bytes ms_total ms_network ms_local sid url type status
+_append_metric() {
+  local ts="$1" file="$2" ext="$3" bytes="$4"
+  local ms_total="$5" ms_network="$6" ms_local="$7"
+  local sid="$8" url="$9" type="${10}" status="${11}"
+
+  # Escape double-quotes in strings (basic safety; filenames rarely contain them)
+  file="${file//\"/\\\"}"
+  url="${url//\"/\\\"}"
+
+  # Build JSON with null for empty optional fields
+  local type_json="null"
+  [[ -n "$type" ]] && type_json="\"$type\""
+
+  local url_json="null"
+  [[ -n "$url" ]] && url_json="\"$url\""
+
+  local sid_json="null"
+  [[ -n "$sid" ]] && sid_json="\"$sid\""
+
+  local line
+  line=$(printf '{"ts":"%s","file":"%s","ext":"%s","bytes":%s,"ms_total":%s,"ms_network":%s,"ms_local":%s,"sid":%s,"url":%s,"type":%s,"status":"%s"}' \
+    "$ts" "$file" "$ext" "$bytes" \
+    "$ms_total" "$ms_network" "$ms_local" \
+    "$sid_json" "$url_json" "$type_json" "$status")
+
+  # Validate JSON before writing (jq -c '.' re-emits compacted valid JSON or fails)
+  if command -v jq &>/dev/null; then
+    local validated
+    validated=$(jq -c '.' <<< "$line" 2>/dev/null) || {
+      echo "METRICS: invalid JSON line — skipping write (line: $line)" >&2
+      return
+    }
+    line="$validated"
+  fi
+
+  # Create file with restricted permissions on first write
+  if [ ! -f "$METRICS_FILE" ]; then
+    install -m 600 /dev/null "$METRICS_FILE"
+  fi
+  printf '%s\n' "$line" >> "$METRICS_FILE"
+}
+
+# Optional Discord webhook notification (fire-and-forget)
+_discord_notify() {
+  local file="$1" ms_total="$2" url="$3"
+  if [[ -n "${MDPUSH_METRICS_DISCORD_WEBHOOK:-}" ]]; then
+    local payload
+    payload=$(printf '{"content":"📤 %s → %dms → %s"}' "$file" "$ms_total" "$url")
+    curl -s -X POST "$MDPUSH_METRICS_DISCORD_WEBHOOK" \
+      -H "Content-Type: application/json" \
+      -A "mdpush-metrics/1.0 (preview-reader-pipeline)" \
+      -d "$payload" \
+      --max-time 3 &
+  fi
+}
+
 # Upload each file
 SUCCESS=0
 FAILED=0
 
 for FILE in "${FILES[@]}"; do
+  # Per-file t_start reset so each JSONL row reflects one file's pipeline, not the batch
+  t_start=$(_now_ms)
+
   # Check file exists
   if [ ! -f "$FILE" ]; then
     echo "SKIP: $FILE (not found)"
@@ -73,26 +181,223 @@ for FILE in "${FILES[@]}"; do
   fi
 
   BASENAME=$(basename "$FILE")
+  EXT="${BASENAME##*.}"
 
-  # Filter to .md/.txt only
-  if [[ ! "$BASENAME" =~ \.(md|txt)$ ]]; then
-    echo "SKIP: $BASENAME (not .md or .txt)"
-    continue
-  fi
+  # Extension whitelist: md, txt, html
+  case "$EXT" in
+    md|txt|html) ;;
+    *)
+      echo "SKIP: $BASENAME (unsupported extension — use .md, .txt, or .html)"
+      continue
+      ;;
+  esac
+
+  # Portable file size: wc -c avoids GNU/BSD stat flag differences
+  BYTES=$(wc -c < "$FILE" | tr -d ' ')
+
+  # --- HTML path: upload to /v/:sid endpoint ---
+  if [ "$EXT" = "html" ]; then
+    # Build query: always ?contentType=html; add &type=<value> if --type was given
+    HTML_QUERY="?contentType=html"
+    if [ -n "$TYPE" ]; then
+      HTML_QUERY="${HTML_QUERY}&type=${TYPE}"
+    fi
+
+    t_pre_curl=$(_now_ms)
+    RESPONSE=$(curl -s -w "\n%{http_code}" \
+      --max-time 60 \
+      -X POST \
+      -H "Authorization: Bearer $TOKEN" \
+      -H "X-Requested-With: XMLHttpRequest" \
+      -F "files=@$FILE" \
+      "${SERVER}/api/projects/${PROJECT}/upload${HTML_QUERY}") || {
+        t_post_curl=$(_now_ms)
+        t_end=$(_now_ms)
+        TS=$(date -u +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ)
+        ms_network=$((t_post_curl - t_pre_curl))
+        ms_local=$((t_pre_curl - t_start))
+        ms_total=$((t_end - t_start))
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "" "" "${TYPE}" "error_network"
+        echo "FAIL: $BASENAME — network error (curl failed)"
+        FAILED=$((FAILED + 1))
+        continue
+      }
+    t_post_curl=$(_now_ms)
+
+    HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+    BODY=$(echo "$RESPONSE" | sed '$d')
+
+    if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+      # Server response includes absolute 'url' field — read it directly
+      URL=""
+      SID=""
+      if command -v jq &>/dev/null; then
+        URL=$(echo "$BODY" | jq -r '.url // .uploaded[0].url // empty' 2>/dev/null || true)
+        SID=$(echo "$BODY" | jq -r '.uploaded[0].sid // .sid // empty' 2>/dev/null || true)
+      else
+        URL=$(python3 -c "import sys,json; d=json.loads(sys.argv[1]); print(d.get('url',d.get('uploaded',[{}])[0].get('url','')))" "$BODY" 2>/dev/null || true)
+        SID=$(python3 -c "import sys,json; d=json.loads(sys.argv[1]); print(d.get('sid',d.get('uploaded',[{}])[0].get('sid','')))" "$BODY" 2>/dev/null || true)
+      fi
 
-  HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-    --max-time 60 \
-    -X POST \
-    -H "Authorization: Bearer $TOKEN" \
-    -F "files=@$FILE" \
-    "${SERVER}/api/projects/${PROJECT}/upload${QUERY}")
+      BADGE=""
+      if [ -n "$TYPE" ]; then
+        BADGE=" [$TYPE]"
+      fi
 
-  if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
-    echo "OK: $BASENAME ($HTTP_CODE)"
-    ((SUCCESS++))
+      t_end=$(_now_ms)
+      TS=$(date -u +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ)
+      ms_network=$((t_post_curl - t_pre_curl))
+      ms_local=$((t_pre_curl - t_start))
+      ms_total=$((t_end - t_start))
+
+      if [ -n "$URL" ]; then
+        echo "OK: $BASENAME${BADGE} → $URL"
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "$SID" "$URL" "${TYPE}" "ok"
+        _discord_notify "$BASENAME" "$ms_total" "$URL"
+      else
+        echo "OK: $BASENAME${BADGE} (HTTP $HTTP_CODE — no URL in response)"
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "$SID" "" "${TYPE}" "ok"
+      fi
+      SUCCESS=$((SUCCESS + 1))
+    else
+      t_end=$(_now_ms)
+      TS=$(date -u +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ)
+      ms_network=$((t_post_curl - t_pre_curl))
+      ms_local=$((t_pre_curl - t_start))
+      ms_total=$((t_end - t_start))
+
+      SERVER_MSG=$(extract_server_message "$BODY")
+      METRIC_STATUS="error_other"
+      case "$HTTP_CODE" in
+        413)
+          echo "FAIL: $BASENAME — file too large (server limit is 15MB)"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          METRIC_STATUS="error_413"
+          ;;
+        415)
+          echo "FAIL: $BASENAME — unsupported media type (server rejected MIME)"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          METRIC_STATUS="error_415"
+          ;;
+        400)
+          echo "FAIL: $BASENAME — bad request (check --type value or file content)"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          METRIC_STATUS="error_400"
+          ;;
+        401|403)
+          echo "FAIL: $BASENAME — authentication error (check token in $CONFIG)"
+          ;;
+        *)
+          echo "FAIL: $BASENAME (HTTP $HTTP_CODE)"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          ;;
+      esac
+      _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+        "$ms_total" "$ms_network" "$ms_local" "" "" "${TYPE}" "$METRIC_STATUS"
+      FAILED=$((FAILED + 1))
+    fi
+
+  # --- Markdown / text path: original behavior ---
   else
-    echo "FAIL: $BASENAME (HTTP $HTTP_CODE)"
-    ((FAILED++))
+    t_pre_curl=$(_now_ms)
+    RESPONSE=$(curl -s -w "\n%{http_code}" \
+      --max-time 60 \
+      -X POST \
+      -H "Authorization: Bearer $TOKEN" \
+      -H "X-Requested-With: XMLHttpRequest" \
+      -F "files=@$FILE" \
+      "${SERVER}/api/projects/${PROJECT}/upload${FOLDER_QUERY}") || {
+        t_post_curl=$(_now_ms)
+        t_end=$(_now_ms)
+        TS=$(date -u +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ)
+        ms_network=$((t_post_curl - t_pre_curl))
+        ms_local=$((t_pre_curl - t_start))
+        ms_total=$((t_end - t_start))
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "" "" "" "error_network"
+        echo "FAIL: $BASENAME — network error (curl failed)"
+        FAILED=$((FAILED + 1))
+        continue
+      }
+    t_post_curl=$(_now_ms)
+
+    HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+    BODY=$(echo "$RESPONSE" | sed '$d')
+
+    if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+      # Try to read absolute url from response first; fall back to SID-based link
+      URL=""
+      SID=""
+      if command -v jq &>/dev/null; then
+        URL=$(echo "$BODY" | jq -r '.url // .uploaded[0].url // empty' 2>/dev/null || true)
+        SID=$(echo "$BODY" | jq -r '.uploaded[0].sid // empty' 2>/dev/null || true)
+      else
+        URL=$(python3 -c "import sys,json; d=json.loads(sys.argv[1]); print(d.get('url',d.get('uploaded',[{}])[0].get('url','')))" "$BODY" 2>/dev/null || true)
+        SID=$(python3 -c "import sys,json; d=json.loads(sys.argv[1]); print(d.get('uploaded',[])[0].get('sid',''))" "$BODY" 2>/dev/null || true)
+      fi
+
+      t_end=$(_now_ms)
+      TS=$(date -u +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ)
+      ms_network=$((t_post_curl - t_pre_curl))
+      ms_local=$((t_pre_curl - t_start))
+      ms_total=$((t_end - t_start))
+
+      if [ -n "$URL" ]; then
+        echo "OK: $BASENAME → $URL"
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "$SID" "$URL" "" "ok"
+        _discord_notify "$BASENAME" "$ms_total" "$URL"
+      elif [ -n "$SID" ]; then
+        echo "OK: $BASENAME → ${SERVER}/p/${PROJECT}/f/${SID}"
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "$SID" "${SERVER}/p/${PROJECT}/f/${SID}" "" "ok"
+        _discord_notify "$BASENAME" "$ms_total" "${SERVER}/p/${PROJECT}/f/${SID}"
+      else
+        echo "OK: $BASENAME (HTTP $HTTP_CODE)"
+        _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+          "$ms_total" "$ms_network" "$ms_local" "" "" "" "ok"
+      fi
+      SUCCESS=$((SUCCESS + 1))
+    else
+      t_end=$(_now_ms)
+      TS=$(date -u +%Y-%m-%dT%H:%M:%S.000Z 2>/dev/null || date -u +%Y-%m-%dT%H:%M:%SZ)
+      ms_network=$((t_post_curl - t_pre_curl))
+      ms_local=$((t_pre_curl - t_start))
+      ms_total=$((t_end - t_start))
+
+      SERVER_MSG=$(extract_server_message "$BODY")
+      METRIC_STATUS="error_other"
+      case "$HTTP_CODE" in
+        413)
+          echo "FAIL: $BASENAME — file too large (server limit is 15MB)"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          METRIC_STATUS="error_413"
+          ;;
+        415)
+          echo "FAIL: $BASENAME — unsupported media type"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          METRIC_STATUS="error_415"
+          ;;
+        400)
+          echo "FAIL: $BASENAME — bad request"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          METRIC_STATUS="error_400"
+          ;;
+        401|403)
+          echo "FAIL: $BASENAME — authentication error (check token in $CONFIG)"
+          ;;
+        *)
+          echo "FAIL: $BASENAME (HTTP $HTTP_CODE)"
+          [ -n "$SERVER_MSG" ] && echo "      Server: $SERVER_MSG"
+          ;;
+      esac
+      _append_metric "$TS" "$BASENAME" "$EXT" "$BYTES" \
+        "$ms_total" "$ms_network" "$ms_local" "" "" "" "$METRIC_STATUS"
+      FAILED=$((FAILED + 1))
+    fi
   fi
 done
 

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "mdpush",
-  "version": "1.0.0",
-  "description": "Push markdown files to Preview Reader from your terminal",
+  "version": "1.1.1",
   "type": "module",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "bin": {
     "mdpush": "./bin/mdpush.js"
@@ -13,26 +12,12 @@
     "bin/",
     "src/",
     "assets/",
+    "README.md",
     "LICENSE"
   ],
-  "keywords": [
-    "markdown",
-    "preview",
-    "reader",
-    "docs",
-    "push",
-    "cli",
-    "upload"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/sielay/preview-reader",
-    "directory": "packages/cli"
+  "scripts": {
+    "prepublishOnly": "bash ./scripts/sync-skill-assets.sh"
   },
-  "homepage": "https://github.com/sielay/preview-reader/tree/master/packages/cli",
-  "bugs": "https://github.com/sielay/preview-reader/issues",
-  "license": "MIT",
-  "author": "sielay",
   "dependencies": {
     "commander": "^12.0.0",
     "chalk": "^5.3.0",

package/src/commands/config-command.js

@@ -5,7 +5,7 @@ import { readConfig } from '../lib/config-store.js'
 export function configCommand() {
   const config = readConfig()
   if (!config.server) {
-    console.log(chalk.yellow('Not configured. Run: mdpush setup'))
+    console.log(chalk.yellow('Not logged in. Run: mdpush login --server <url>'))
     return
   }
 
@@ -13,7 +13,4 @@ export function configCommand() {
   console.log(`  Server:   ${config.server}`)
   console.log(`  Username: ${config.username}`)
   console.log(`  Token:    ${config.token ? '[stored]' : 'none'}`)
-  if (config.defaultProject) {
-    console.log(`  Project:  ${config.defaultProject}`)
-  }
 }

package/src/commands/login-command.js

@@ -2,7 +2,7 @@ import chalk from 'chalk'
 import prompts from 'prompts'
 import { writeConfig } from '../lib/config-store.js'
 
-/** Login to Preview Reader server — prompts credentials, stores API token */
+/** Login to sielay server — prompts credentials, stores API token */
 export async function loginCommand(options) {
   const server = options.server.replace(/\/$/, '')
 
@@ -29,14 +29,19 @@ export async function loginCommand(options) {
       throw new Error(err.error || `Login failed (${loginRes.status})`)
     }
 
-    const { token: jwt } = await loginRes.json()
+    // The login body intentionally carries no JWT (audit LOW — httpOnly cookie
+    // only), so relay the session cookie to mint the revocable API token.
+    const jwtCookie = (loginRes.headers.getSetCookie?.() || [])
+      .map(c => c.split(';')[0])
+      .find(c => c.startsWith('jwt='))
+    if (!jwtCookie) throw new Error('Login succeeded but no session cookie received')
 
     // Step 2: Generate API token for CLI
     const tokenRes = await fetch(`${server}/api/auth/tokens`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'Authorization': `Bearer ${jwt}`
+        'Cookie': jwtCookie
       },
       body: JSON.stringify({ name: 'mdpush-cli' })
     })

package/src/commands/push-command.js

@@ -5,18 +5,22 @@ import ora from 'ora'
 import { apiRequest } from '../lib/api-request.js'
 import { readConfig } from '../lib/config-store.js'
 
-/** Push markdown files to a project */
+const HTML_TYPE_WHITELIST = new Set(['spec', 'review', 'design', 'report', 'playground'])
+
+const isHtml = (f) => /\.html$/i.test(f)
+const isPdf = (f) => /\.pdf$/i.test(f)
+const isMdTxt = (f) => /\.(md|txt)$/i.test(f)
+
+/** Push markdown, text, and HTML artifact files to a project */
 export async function pushCommand(files, options) {
-  const config = readConfig()
-  const project = options.project || config.defaultProject
-  const { folder } = options
+  const { project, folder, type } = options
 
-  if (!project) {
-    console.log(chalk.red('No project specified. Use -p <slug> or run: mdpush setup'))
-    process.exit(1)
+  if (type && !HTML_TYPE_WHITELIST.has(type)) {
+    console.log(chalk.red(`Invalid --type "${type}". Allowed: ${[...HTML_TYPE_WHITELIST].join('|')}`))
+    process.exit(2)
   }
 
-  // Resolve file list — expand directories
+  // Resolve file list — expand directories (md/txt only inside dirs)
   const resolvedFiles = []
   for (const f of files) {
     const stat = fs.statSync(f, { throwIfNoEntry: false })
@@ -25,44 +29,92 @@ export async function pushCommand(files, options) {
       continue
     }
     if (stat.isDirectory()) {
+      // Directory expansion stays md/txt-only — don't sweep up large binaries
+      // (HTML/PDF) implicitly; pass those as explicit file args.
       const dirFiles = fs.readdirSync(f, { recursive: true })
-        .filter(name => /\.(md|txt)$/i.test(name))
+        .filter(name => isMdTxt(name))
         .map(name => path.join(f, name))
       resolvedFiles.push(...dirFiles)
-    } else if (/\.(md|txt)$/i.test(f)) {
+    } else if (isMdTxt(f) || isHtml(f) || isPdf(f)) {
       resolvedFiles.push(f)
     } else {
-      console.log(chalk.yellow(`Skipping: ${f} (not .md or .txt)`))
+      console.log(chalk.yellow(`Skipping: ${f} (not .md, .txt, .html, or .pdf)`))
     }
   }
 
   if (resolvedFiles.length === 0) {
-    console.log(chalk.red('No .md or .txt files to upload.'))
+    console.log(chalk.red('No .md, .txt, .html, or .pdf files to upload.'))
     process.exit(1)
   }
 
+  const htmlFiles = resolvedFiles.filter(isHtml)
+  const otherFiles = resolvedFiles.filter(f => !isHtml(f))
+
+  if (htmlFiles.length > 0 && folder) {
+    console.log(chalk.yellow(`Note: --folder is ignored for HTML uploads (artifacts are flat by design)`))
+  }
+
   console.log(chalk.blue(`Uploading ${resolvedFiles.length} file(s) to ${project}${folder ? `/${folder}` : ''}...`))
 
+  const uploadedFiles = []
   let success = 0
   let failed = 0
 
+  // Per-file dispatch — mirrors push.sh behavior, simpler than batched FormData
   for (const filePath of resolvedFiles) {
-    const spinner = ora(`Uploading ${path.basename(filePath)}`).start()
+    const basename = path.basename(filePath)
+    const spinner = ora(`Uploading ${basename}`).start()
     try {
       const formData = new FormData()
       const content = fs.readFileSync(filePath)
-      formData.append('files', new Blob([content]), path.basename(filePath))
+      formData.append('files', new Blob([content]), basename)
 
-      const url = `/api/projects/${project}/upload${folder ? `?folder=${encodeURIComponent(folder)}` : ''}`
-      await apiRequest(url, { method: 'POST', headers: {}, body: formData })
+      const html = isHtml(filePath)
+      const pdf = isPdf(filePath)
+      const params = new URLSearchParams()
+      if (html) {
+        params.set('contentType', 'html')
+        if (type) params.set('type', type)
+      } else if (pdf) {
+        params.set('contentType', 'pdf')
+        if (folder) params.set('folder', folder)
+      } else if (folder) {
+        params.set('folder', folder)
+      }
+      const query = params.toString() ? `?${params.toString()}` : ''
+      const url = `/api/projects/${project}/upload${query}`
 
-      spinner.succeed(chalk.green(path.basename(filePath)))
+      const res = await apiRequest(url, {
+        method: 'POST',
+        headers: { 'X-Requested-With': 'XMLHttpRequest' },
+        body: formData
+      })
+      const data = await res.json()
+
+      spinner.succeed(chalk.green(basename))
       success++
+
+      if (data.uploaded) uploadedFiles.push(...data.uploaded)
     } catch (err) {
-      spinner.fail(chalk.red(`${path.basename(filePath)}: ${err.message}`))
+      spinner.fail(chalk.red(`${basename}: ${err.message}`))
       failed++
     }
   }
 
   console.log(`\n${chalk.green(`${success} uploaded`)}${failed ? `, ${chalk.red(`${failed} failed`)}` : ''}`)
+
+  if (uploadedFiles.length > 0) {
+    const config = readConfig()
+    for (const f of uploadedFiles) {
+      if (!f.sid) continue
+      if (f.url) {
+        // HTML artifact: server emits viewer URL
+        const badge = f.type ? chalk.magenta(`[${f.type}] `) : ''
+        console.log(chalk.cyan(`-> ${badge}${f.url}  ${f.name}`))
+      } else {
+        // md/txt: legacy /p/<slug>/f/<sid> path
+        console.log(chalk.cyan(`-> ${config.server}/p/${project}/f/${f.sid}  ${f.name}`))
+      }
+    }
+  }
 }

package/src/commands/skill-command.js

@@ -0,0 +1,124 @@
+import fs from 'fs'
+import path from 'path'
+import os from 'os'
+import chalk from 'chalk'
+import ora from 'ora'
+import { apiRequest } from '../lib/api-request.js'
+
+/**
+ * `mdpush skill push <dir>` / `mdpush skill install <slug>` — publish a Claude
+ * Code skill bundle to sielay (project kind='skill') and pull one back down
+ * into ~/.claude/skills/. Server counterpart: GET /api/skills(+/:slug/manifest).
+ */
+
+// Mirrors the server's TEXT_UPLOAD_EXTENSIONS (upload-middleware.js)
+const SKILL_FILE_EXTENSIONS = new Set(['.md', '.txt', '.py', '.sh', '.js', '.mjs', '.cjs', '.ps1', '.json', '.yaml', '.yml'])
+
+/** Recursive walk: relative POSIX paths, dotfiles + node_modules skipped. */
+function walkSkillDir(root, rel = '') {
+  const out = []
+  for (const e of fs.readdirSync(path.join(root, rel), { withFileTypes: true })) {
+    if (e.name.startsWith('.') || e.name === 'node_modules') continue
+    const relPath = rel ? `${rel}/${e.name}` : e.name
+    if (e.isDirectory()) out.push(...walkSkillDir(root, relPath))
+    else if (e.isFile() && SKILL_FILE_EXTENSIONS.has(path.extname(e.name).toLowerCase())) out.push(relPath)
+  }
+  return out
+}
+
+/** Push a local skill directory to the server as a kind='skill' project. */
+export async function skillPushCommand(dir, options) {
+  const root = path.resolve(dir)
+  if (!fs.existsSync(path.join(root, 'SKILL.md'))) {
+    console.log(chalk.red(`No SKILL.md in ${root} — not a skill directory.`))
+    process.exit(2)
+  }
+
+  const slug = options.project || path.basename(root).toLowerCase().replace(/[^a-z0-9-]+/g, '-')
+  const files = walkSkillDir(root)
+  if (!files.includes('SKILL.md')) files.unshift('SKILL.md')
+
+  // Ensure the skill project exists (idempotent: reuse when slug matches)
+  const listRes = await apiRequest('/api/projects')
+  const projects = await listRes.json()
+  let project = projects.find(p => p.slug === slug)
+  if (project && project.kind !== 'skill') {
+    console.log(chalk.red(`Project "${slug}" exists but is kind='${project.kind}', not a skill. Aborting.`))
+    process.exit(2)
+  }
+  if (!project) {
+    const createRes = await apiRequest('/api/projects', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: slug, kind: 'skill' })
+    })
+    project = await createRes.json()
+    console.log(chalk.blue(`Created skill project "${project.slug}"`))
+  }
+
+  console.log(chalk.blue(`Pushing ${files.length} file(s) to skill "${project.slug}"...`))
+  let success = 0, failed = 0
+  for (const relPath of files) {
+    const spinner = ora(relPath).start()
+    try {
+      const formData = new FormData()
+      formData.append('files', new Blob([fs.readFileSync(path.join(root, relPath))]), path.basename(relPath))
+      const folder = path.dirname(relPath)
+      const query = folder && folder !== '.' ? `?folder=${encodeURIComponent(folder)}` : ''
+      await apiRequest(`/api/projects/${project.slug}/upload${query}`, {
+        method: 'POST',
+        headers: { 'X-Requested-With': 'XMLHttpRequest' },
+        body: formData
+      })
+      spinner.succeed(chalk.green(relPath))
+      success++
+    } catch (err) {
+      spinner.fail(chalk.red(`${relPath}: ${err.message}`))
+      failed++
+    }
+  }
+  console.log(`\n${chalk.green(`${success} pushed`)}${failed ? `, ${chalk.red(`${failed} failed`)}` : ''}`)
+  if (failed) process.exit(1)
+}
+
+/** Install a published skill into ~/.claude/skills/<slug> (or --dest). */
+export async function skillInstallCommand(slug, options) {
+  const manifestRes = await apiRequest(`/api/skills/${slug}/manifest`)
+  const manifest = await manifestRes.json()
+
+  const dest = path.resolve(options.dest || path.join(os.homedir(), '.claude', 'skills', slug))
+  console.log(chalk.blue(`Installing "${manifest.name || slug}" → ${dest} (${manifest.files.length} files)`))
+
+  let success = 0, failed = 0
+  for (const f of manifest.files) {
+    const spinner = ora(f.path).start()
+    try {
+      // Guard: manifest paths are server-generated, but never trust a path
+      // that would escape the destination directory.
+      const target = path.join(dest, f.path)
+      if (!target.startsWith(dest + path.sep)) throw new Error('Unsafe path in manifest')
+      const encoded = f.path.split('/').map(encodeURIComponent).join('/')
+      const res = await apiRequest(`/api/projects/${slug}/download/${encoded}`)
+      fs.mkdirSync(path.dirname(target), { recursive: true })
+      fs.writeFileSync(target, Buffer.from(await res.arrayBuffer()))
+      if (target.endsWith('.sh')) { try { fs.chmodSync(target, 0o755) } catch {} }
+      spinner.succeed(chalk.green(f.path))
+      success++
+    } catch (err) {
+      spinner.fail(chalk.red(`${f.path}: ${err.message}`))
+      failed++
+    }
+  }
+  console.log(`\n${chalk.green(`${success} installed`)}${failed ? `, ${chalk.red(`${failed} failed`)}` : ''}`)
+  if (failed) process.exit(1)
+}
+
+/** List published skills. */
+export async function skillListCommand() {
+  const res = await apiRequest('/api/skills')
+  const skills = await res.json()
+  if (skills.length === 0) return console.log(chalk.yellow('No skills published.'))
+  for (const s of skills) {
+    console.log(`${chalk.cyan(s.slug.padEnd(24))} ${s.description || chalk.gray('(no description)')}`)
+  }
+}

package/src/index.js

@@ -3,16 +3,12 @@ import { loginCommand } from './commands/login-command.js'
 import { pushCommand } from './commands/push-command.js'
 import { configCommand } from './commands/config-command.js'
 import { logoutCommand } from './commands/logout-command.js'
-import { setupCommand } from './commands/setup-command.js'
+import { skillPushCommand, skillInstallCommand, skillListCommand } from './commands/skill-command.js'
 
 program
   .name('mdpush')
-  .description('Push markdown files to Preview Reader')
-  .version('1.0.0')
-
-program.command('setup')
-  .description('Interactive setup — configure server, token, and default project')
-  .action(setupCommand)
+  .description('Push markdown, text, and HTML artifact files to sielay')
+  .version('1.1.0')
 
 program.command('login')
   .description('Authenticate with server')
@@ -20,12 +16,32 @@ program.command('login')
   .action(loginCommand)
 
 program.command('push')
-  .description('Upload files to a project')
-  .option('-p, --project <slug>', 'Project slug')
-  .option('-f, --folder <path>', 'Target folder within project')
+  .description('Upload .md/.txt/.html files to a project')
+  .requiredOption('-p, --project <slug>', 'Project slug')
+  .option('-f, --folder <path>', 'Target folder within project (md/txt only)')
+  .option('-t, --type <value>', 'HTML artifact type: spec|review|design|report|playground (HTML files only)')
   .argument('<files...>', 'Files or directory to upload')
   .action(pushCommand)
 
+const skill = program.command('skill')
+  .description('Publish and install Claude Code skill bundles (projects with kind=skill)')
+
+skill.command('push')
+  .description('Push a skill directory (must contain SKILL.md) to the server')
+  .argument('<dir>', 'Skill directory')
+  .option('-p, --project <slug>', 'Project slug (default: directory name)')
+  .action(skillPushCommand)
+
+skill.command('install')
+  .description('Install a published skill into ~/.claude/skills/<slug>')
+  .argument('<slug>', 'Skill slug (see: mdpush skill list)')
+  .option('-d, --dest <path>', 'Destination directory (default: ~/.claude/skills/<slug>)')
+  .action(skillInstallCommand)
+
+skill.command('list')
+  .description('List skills published on the server')
+  .action(skillListCommand)
+
 program.command('config')
   .description('Show stored configuration')
   .action(configCommand)

package/src/lib/api-request.js

@@ -1,6 +1,6 @@
 import { readConfig } from './config-store.js'
 
-/** Make authenticated HTTP request to Preview Reader server */
+/** Make authenticated HTTP request to sielay server */
 export async function apiRequest(path, options = {}) {
   const config = readConfig()
   if (!config.server || !config.token) {