replicas-cli 0.2.483 → 0.2.485

package/dist/index.mjs

@@ -9312,7 +9312,7 @@ Use public access only when the media must render without Replicas authenticatio
 replicas media upload screenshot.png --name "Login page" --access public
 \`\`\`
 
-\`--share\` remains an alias for \`--access public\`. Public access prints an additional \`Forge embed\` for media or \`Forge link\` for HTML, backed by an opt-in bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. Use \`replicas media share <media-id>\` to rotate it and \`replicas media revoke <media-id>\` to revoke it.
+\`--share\` remains an alias for \`--access public\`. Public access prints an additional \`Forge embed\` for image, video, or audio media, backed by an opt-in bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. HTML pages only support organization access. Use \`replicas media share <media-id>\` to rotate a public media URL and \`replicas media revoke <media-id>\` to revoke it.
 
 ## The URLs the CLI gives you \u2014 and where each one is allowed
 
@@ -9320,7 +9320,7 @@ replicas media upload screenshot.png --name "Login page" --access public
 |---|---|---|
 | \`https://api.tryreplicas.com/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
 | \`https://tryreplicas.com/organizations/<organization-id>/media/<media-id>\` | Organization-only page printed by \`--access organization\` | Pull requests and other places where every viewer belongs to the Replicas organization. |
-| \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | GitHub image embeds and intentionally public HTML page links. |
+| \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | GitHub embeds for image, video, or audio media. |
 | \`https://tryreplicas.com/workspaces/<workspace-id>?media=<media-id>\` | Authenticated dashboard deep link that opens the media file in the workspace | Everywhere external \u2014 Slack, GitHub, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
@@ -9496,7 +9496,7 @@ GitHub does not reliably render arbitrary external videos as inline players. For
 
 Public forge shares are bearer capabilities. For private repositories, create one only when the user asked for inline PR media. Revoke with \`replicas media revoke <media-id>\` **only** when the user asks or the media should intentionally stop rendering \u2014 never as routine post-task cleanup, since revoking breaks every embed already posted on the PR.
 
-For a self-contained HTML report, upload it with \`--access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. GitHub cannot render the page inline, so use the normal link rather than image syntax. Use \`--access public\` only when the user explicitly wants unauthenticated access.
+For a self-contained HTML report, upload it with \`--access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. GitHub cannot render the page inline, so use the normal link rather than image syntax. HTML pages cannot be shared publicly.
 
 Do **not** commit screenshots to the repo, use placeholder URLs, expose the authenticated \`/v1/media/<id>\` URL, or automate GitHub's undocumented browser upload flow.
 
@@ -9546,8 +9546,8 @@ replicas media upload chart-a.svg chart-b.svg --name "Latency chart" --name "Err
 - \`--kind <image|video|audio|html>\` \u2014 override auto-detection
 - \`--name <name>\`: required display name shown in the dashboard, one per file in order
 - \`--session-id <id>\` \u2014 associate the upload with a specific session
-- \`--access organization|public\`: create an organization-only page link or a public bearer URL
-- \`--share\`: alias for \`--access public\`
+- \`--access organization|public\`: create an organization-only link, or a public bearer URL for non-HTML media
+- \`--share\`: alias for \`--access public\`; not supported for HTML
 `;
 var MEDIA_ABILITY = {
   label: "Media",
@@ -10141,7 +10141,7 @@ function formatTurnElapsed(ms) {
 }
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.483";
+var CLI_VERSION = "0.2.485";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -27519,6 +27519,10 @@ var MEDIA_KIND = {
   HTML: "html"
 };
 var MEDIA_KINDS = [MEDIA_KIND.IMAGE, MEDIA_KIND.VIDEO, MEDIA_KIND.AUDIO, MEDIA_KIND.HTML];
+var PUBLIC_MEDIA_KINDS = [MEDIA_KIND.IMAGE, MEDIA_KIND.VIDEO, MEDIA_KIND.AUDIO];
+function isPublicMediaKind(value) {
+  return PUBLIC_MEDIA_KINDS.some((kind) => kind === value);
+}
 var MAX_ENGINE_LOG_BYTES = 50 * 1024 * 1024;
 
 // ../shared/src/sse.ts
@@ -30585,7 +30589,7 @@ function resolveKind(ext, override) {
   }
   return inferred;
 }
-async function uploadOne(filePath, displayName, options) {
+async function uploadOne(filePath, displayName, kind, options) {
   const absPath = path5.resolve(filePath);
   if (!fs4.existsSync(absPath)) {
     throw new Error(`File not found: ${absPath}`);
@@ -30599,7 +30603,6 @@ async function uploadOne(filePath, displayName, options) {
   }
   const fileName = path5.basename(absPath);
   const ext = path5.extname(absPath).slice(1).toLowerCase();
-  const kind = resolveKind(ext, options.kind);
   const contentType = mediaInfo(ext)?.contentType ?? "application/octet-stream";
   const form = new FormData();
   form.append("file", new Blob([fs4.readFileSync(absPath)], { type: contentType }), fileName);
@@ -30634,8 +30637,17 @@ async function mediaUploadCommand(filePaths, options) {
   if (names.some((name) => !name.trim())) {
     throw new Error("--name must not be empty.");
   }
-  const results = await Promise.allSettled(filePaths.map((p, i) => uploadOne(p, names[i], options)));
   const publicAccess = options.share || options.access === "public";
+  const kinds = filePaths.map((filePath) => {
+    const ext = path5.extname(filePath).slice(1).toLowerCase();
+    return resolveKind(ext, options.kind);
+  });
+  if (publicAccess && kinds.some((kind) => !isPublicMediaKind(kind))) {
+    throw new Error("HTML pages only support organization access. Use --access organization.");
+  }
+  const results = await Promise.allSettled(
+    filePaths.map((filePath, i) => uploadOne(filePath, names[i], kinds[i], options))
+  );
   const shareResults = publicAccess ? await Promise.allSettled(
     results.map(
       (result) => result.status === "fulfilled" ? shareMedia(result.value.media.id) : Promise.resolve(null)
@@ -30660,9 +30672,7 @@ async function mediaUploadCommand(filePaths, options) {
       if (publicAccess) {
         const shareResult = shareResults[i];
         if (shareResult.status === "fulfilled" && shareResult.value) {
-          console.log(
-            media.kind === MEDIA_KIND.HTML ? `Forge link: [View ${options.name?.[i] ?? fileName}](${shareResult.value})` : `Forge embed: ![${fileName}](${shareResult.value})`
-          );
+          console.log(`Forge embed: ![${fileName}](${shareResult.value})`);
         } else {
           const error51 = shareResult.status === "rejected" ? shareResult.reason : new Error("Missing public share URL");
           failures.push({
@@ -35597,7 +35607,7 @@ if (isAgentMode()) {
     "Required human-facing display name shown in the dashboard. Pass one --name per file, in order.",
     (value, previous) => [...previous, value],
     []
-  ).option("--access <access>", "Link access: organization (sign-in required) or public (bearer URL)").option("--share", "Alias for --access public").action(async (files, options) => {
+  ).option("--access <access>", "Link access: organization (sign-in required) or public (non-HTML bearer URL)").option("--share", "Alias for --access public; not supported for HTML").action(async (files, options) => {
     try {
       await mediaUploadCommand(files, options);
     } catch (error51) {
@@ -35609,7 +35619,7 @@ if (isAgentMode()) {
       process.exit(1);
     }
   });
-  media.command("share <mediaId>").description("Create or rotate a public forge URL for uploaded media").action(async (mediaId) => {
+  media.command("share <mediaId>").description("Create or rotate a public forge URL for uploaded image, video, or audio media").action(async (mediaId) => {
     try {
       await mediaShareCommand(mediaId);
     } catch (error51) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.483",
+  "version": "0.2.485",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.mjs",
   "bin": {