replicas-cli 0.2.366 → 0.2.367

package/dist/index.mjs

@@ -8357,7 +8357,9 @@ gh pr review 123 --request-changes --body "Changes needed"
 GitHub does NOT have a public API for uploading images to PRs/issues. When you need to include images:
 - Do NOT use placeholder image URLs
 - Do NOT commit screenshots as files to the repository
-- Use the \`replicas-agent\` skill to share the image
+- Run \`replicas media upload <image> --share\` and put the printed \`Forge embed\` Markdown in the PR body or comment
+- For video, embed a shared poster image linked to the recording's **View in Replicas** URL; GitHub does not reliably render externally hosted video inline
+- Treat the public URL as an opt-in bearer capability and revoke it with \`replicas media revoke <media-id>\` when appropriate
 - If you were triggered from Slack, also upload the image to the Slack thread so the user can see it directly
 `;
 var GITHUB_ABILITY = {
@@ -8417,6 +8419,23 @@ curl -s -H "Authorization: Bearer $TOKEN" "https://gitlab.com/api/v4/projects/<u
 \`\`\`
 
 Use the repo's own host in the API base URL for self-managed instances.
+
+## Inline media in merge requests
+
+GitLab provides a supported project Markdown uploads API. Upload media to Replicas first, then upload the same bytes natively so repository permissions protect the asset:
+
+\`\`\`bash
+FILE=/abs/path/to/screenshot.png
+PROJECT=$(python3 -c 'import urllib.parse; print(urllib.parse.quote("group/project", safe=""))')
+TOKEN=$(grep -m1 '://oauth2:' ~/.git-credentials | sed -E 's#https://oauth2:([^@]+)@.*#\\1#')
+UPLOAD=$(curl -sS --request POST \\
+  --header "Authorization: Bearer $TOKEN" \\
+  --form "file=@$FILE" \\
+  "https://gitlab.com/api/v4/projects/$PROJECT/uploads")
+echo "$UPLOAD" | jq -r .markdown
+\`\`\`
+
+Use the repository's own host for self-managed GitLab. Insert the returned \`markdown\` into the merge request description or comment and add the media's **View in Replicas** dashboard link. Images render inline; MP4, MOV, and WebM render as inline video players. Do not create a public Replicas forge share when this native upload succeeds.
 `;
 var GITLAB_ABILITY = {
   label: "GitLab",
@@ -8930,11 +8949,20 @@ For each file, the CLI prints two lines:
 
 Match each "View in Replicas" line to the embed line directly above it \u2014 that's the deep link for that file.
 
+Pass \`--share\` only when the media must render on an external forge:
+
+\`\`\`bash
+replicas media upload screenshot.png --share
+\`\`\`
+
+This prints an additional \`Forge embed\` Markdown line backed by an opt-in public bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. Use \`replicas media share <media-id>\` to rotate it and \`replicas media revoke <media-id>\` to revoke it.
+
 ## The two URLs the CLI gives you \u2014 and where each one is allowed
 
 | URL | What it is | Where it's allowed |
 |---|---|---|
 | \`https://api.tryreplicas.com/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
+| \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--share\` | GitHub image embeds only. |
 | \`https://tryreplicas.com/workspaces/<workspace-id>?mode=media&media=<media-id>\` | Public dashboard deep link to the media tab, scrolled to that specific file | Everywhere external \u2014 Slack, GitHub, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
@@ -8979,7 +9007,7 @@ Sharing media externally is a **two-step requirement** for every file:
 
 A link alone is not enough. A native upload alone is not enough. Do both.
 
-The one exception is GitHub, which has no public image upload API \u2014 there, the dashboard link is the only option (see below).
+GitHub has no native upload API, so use an explicit Replicas public share for screenshots and recording previews. GitLab has a native upload API and should receive the original bytes.
 
 ### Slack \u2014 embed natively via the 3-step external file upload flow
 
@@ -9091,20 +9119,34 @@ The same flow works for issue bodies (use \`issueCreate\` / \`issueUpdate\` with
 
 Never paste the \`api.tryreplicas.com/v1/media/<id>\` URL into a Linear body or comment \u2014 it will render as a broken image to anyone outside your Replicas chat.
 
-### GitHub \u2014 link the dashboard deep link (no public upload API exists)
+### GitHub: inline screenshots and recording previews
+
+GitHub has **no public API** for uploading attachments to PRs or issues. Its web UI uses an undocumented internal endpoint that API clients must not emulate. For screenshots, explicitly create a forge share and put the printed \`Forge embed\` Markdown directly in the PR body or comment, followed by the dashboard link:
+
+\`\`\`bash
+replicas media upload /tmp/screenshot.png --share
+\`\`\`
 
-GitHub has **no public API** for uploading images to PRs or issues. Their web UI uses an undocumented internal endpoint that's not available to API clients. So for GitHub specifically, the only correct way to share media is the dashboard deep link, rendered as a markdown hyperlink:
+GitHub does not reliably render arbitrary external videos as inline players. For a recording:
+
+1. Upload the MP4 normally so it remains available in Replicas.
+2. Generate a poster image from the recording: \`ffmpeg -i /tmp/demo.mp4 -frames:v 1 /tmp/demo-poster.png\`.
+3. Upload the poster with \`--share\`.
+4. Wrap the poster embed in a link to the recording's **View in Replicas** URL.
 
 \`\`\`markdown
-[View in Replicas](https://tryreplicas.com/workspaces/<workspace-id>?mode=media&media=<media-id>)
+[![Demo recording](<public-poster-url>)](<recording-dashboard-url>)
 \`\`\`
 
-Do **not**:
-- Commit screenshots as files to the repo as a workaround.
-- Use placeholder image URLs.
-- Embed the \`api.tryreplicas.com/v1/media/<id>\` URL in markdown \u2014 it renders as a broken image for every viewer.
+Public forge shares are bearer capabilities. For private repositories, create one only when the user asked for inline PR media, and revoke it with \`replicas media revoke <media-id>\` when it should stop resolving.
+
+Do **not** commit screenshots to the repo, use placeholder URLs, expose the authenticated \`/v1/media/<id>\` URL, or automate GitHub's undocumented browser upload flow.
+
+### GitLab: native inline screenshots and videos
 
-This applies to PR descriptions, PR review comments, issue bodies, issue comments, and commit messages.
+GitLab supports native project Markdown uploads. Always upload the media to Replicas first, then POST the same original file to the repository's \`/projects/:id/uploads\` API using the workspace GitLab credential. Insert the returned \`markdown\` value into the merge request body or comment and include the Replicas dashboard link. Image uploads render inline; MP4, MOV, and WebM uploads render as inline video players.
+
+Do not use a Replicas public forge share for GitLab when the native project upload succeeds; native uploads preserve project access controls.
 
 ## Recording defaults
 
@@ -9144,6 +9186,7 @@ replicas media upload chart-a.svg chart-b.svg --kind image
 
 - \`--kind <image|video|audio>\` \u2014 override auto-detection
 - \`--session-id <id>\` \u2014 associate the upload with a specific session
+- \`--share\`: create a revocable public bearer URL for a forge image embed
 `;
 var MEDIA_ABILITY = {
   label: "Media",
@@ -9693,7 +9736,7 @@ var HOOK_EXEC_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 var REPLICAS_CONFIG_FILENAMES = ["replicas.json", "replicas.yaml", "replicas.yml"];
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.366";
+var CLI_VERSION = "0.2.367";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -14681,6 +14724,15 @@ async function previewRemoveCommand(workspaceId, options) {
 // src/commands/media.ts
 import fs4 from "fs";
 import path5 from "path";
+function publicMediaUrl(mediaId, token) {
+  return `${MONOLITH_URL4}/v1/media/public/${mediaId}/${token}`;
+}
+async function shareMedia(mediaId) {
+  const { token } = await agentFetch(`/v1/engine/media/${mediaId}/share`, {
+    method: "POST"
+  });
+  return publicMediaUrl(mediaId, token);
+}
 var MONOLITH_URL4 = process.env.MONOLITH_URL || process.env.REPLICAS_MONOLITH_URL || "https://api.tryreplicas.com";
 function mediaInfo(ext) {
   const { kind, mimeType } = classifyCanvasFilename(`.${ext}`);
@@ -14741,6 +14793,17 @@ async function mediaUploadCommand(filePaths, options) {
     if (result.status === "fulfilled") {
       const { fileName, media } = result.value;
       console.log(`![${fileName}](${MONOLITH_URL4}/v1/media/${media.id})`);
+      if (options.share) {
+        try {
+          console.log(`Forge embed: ![${fileName}](${await shareMedia(media.id)})`);
+        } catch (error) {
+          failures.push({
+            filePath: filePaths[i],
+            operation: "share",
+            error: error instanceof Error ? error : new Error(String(error))
+          });
+        }
+      }
       if (config2?.workspace_id) {
         const deepLink = getWorkspaceDashboardUrl(config2.workspace_id, {
           mode: "media",
@@ -14750,14 +14813,21 @@ async function mediaUploadCommand(filePaths, options) {
       }
     } else {
       const error = result.reason instanceof Error ? result.reason : new Error(String(result.reason));
-      failures.push({ filePath: filePaths[i], error });
+      failures.push({ filePath: filePaths[i], operation: "upload", error });
     }
   }
   if (failures.length > 0) {
-    const detail = failures.map((f) => `${f.filePath}: ${f.error.message}`).join("; ");
-    throw new Error(`${failures.length} of ${filePaths.length} upload(s) failed \u2014 ${detail}`);
+    const detail = failures.map((f) => `${f.filePath} ${f.operation}: ${f.error.message}`).join("; ");
+    throw new Error(`${failures.length} media operation(s) failed \u2014 ${detail}`);
   }
 }
+async function mediaShareCommand(mediaId) {
+  console.log(await shareMedia(mediaId));
+}
+async function mediaRevokeCommand(mediaId) {
+  await agentFetch(`/v1/engine/media/${mediaId}/share`, { method: "DELETE" });
+  console.log(`Revoked public share for ${mediaId}`);
+}
 async function mediaListCommand(options) {
   const qs = new URLSearchParams();
   if (options.kind) qs.set("kind", options.kind);
@@ -22085,7 +22155,7 @@ if (isAgentMode()) {
 }
 if (isAgentMode()) {
   const media = program.command("media").description("Share workspace media (screenshots, videos, audio) inline in chat");
-  media.command("upload <files...>").description("Upload one or more screenshot, video, or audio files. Multiple files are uploaded concurrently. Prints a markdown embed per file for the assistant reply.").option("-k, --kind <kind>", "Media kind: image, video, or audio (inferred from extension if omitted)").option("-s, --session-id <id>", "Session ID to associate the asset with").action(async (files, options) => {
+  media.command("upload <files...>").description("Upload one or more screenshot, video, or audio files. Multiple files are uploaded concurrently. Prints a markdown embed per file for the assistant reply.").option("-k, --kind <kind>", "Media kind: image, video, or audio (inferred from extension if omitted)").option("-s, --session-id <id>", "Session ID to associate the asset with").option("--share", "Create an opt-in public forge embed URL for each asset").action(async (files, options) => {
     try {
       await mediaUploadCommand(files, options);
     } catch (error) {
@@ -22097,6 +22167,26 @@ if (isAgentMode()) {
       process.exit(1);
     }
   });
+  media.command("share <mediaId>").description("Create or rotate a public forge embed URL for uploaded media").action(async (mediaId) => {
+    try {
+      await mediaShareCommand(mediaId);
+    } catch (error) {
+      if (error instanceof Error) console.error(chalk24.red(`
+\u2717 ${error.message}
+`));
+      process.exit(1);
+    }
+  });
+  media.command("revoke <mediaId>").description("Revoke the public forge embed URL for uploaded media").action(async (mediaId) => {
+    try {
+      await mediaRevokeCommand(mediaId);
+    } catch (error) {
+      if (error instanceof Error) console.error(chalk24.red(`
+\u2717 ${error.message}
+`));
+      process.exit(1);
+    }
+  });
   media.command("list").description("List media uploaded for this workspace").option("-k, --kind <kind>", "Filter by kind: image, video, or audio").option("-l, --limit <n>", "Page size (default 50, max 200)").option("-p, --page <n>", "Page number (default 1)").action(async (options) => {
     try {
       await mediaListCommand(options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.366",
+  "version": "0.2.367",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.mjs",
   "bin": {