cinna-cli 0.5.2__tar.gz → 0.5.3__tar.gz

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cinna-cli
-Version: 0.5.2
+Version: 0.5.3
 Summary: Local development CLI for Cinna Core agents
 Project-URL: Homepage, https://github.com/opencinna/cinna-cli
 Project-URL: Repository, https://github.com/opencinna/cinna-cli
@@ -575,7 +575,7 @@ Hand work to a remote agent as a **durable delegation** — a platform task with
 
 - `create --id KEY --target AGENT_UUID --title T --brief B [--execute]` — the identity is `--target` + `--id`: a retry with the same pair returns the original task (changed title/brief are ignored) and never launches execution twice (the backend deduplicates). Prints the backend **task id** the other commands take, and whether it executes. `--depth 2 --root ROOT` makes a sub-delegation (`--root` is required at depth 2, not allowed at depth 1); `--group` tags related work.
 - `status TASK_ID` — one read: state, latest result, and any open question with its result id. A requester agent should end its turn and let Cinna Desktop deliver the result rather than poll.
-- `report [TASK_ID] --status in_progress|blocked|done|failed --summary S` — `blocked` needs `--question`; `--audience user` when a human must decide (default `requester`). `--artifact` (repeatable) is a JSON object with non-empty `kind` (backend accepts `file` or `link`), `name` and an `http(s)` `ref` — upload local files separately. `--body` adds detail.
+- `report [TASK_ID] --status in_progress|blocked|done|failed --summary S` — `blocked` needs `--question`; `--audience user` when a human must decide (default `requester`). `--artifact` (repeatable) is a JSON object with non-empty `kind` (backend accepts `file` or `link`), `name` and an `http(s)` `ref` — upload local files separately (`cinna artifacts publish` prints such a link). `--body` adds detail.
 - **Inside a cloud task**, omit `TASK_ID`: the report goes to the current task using `AGENT_AUTH_TOKEN`, `BACKEND_URL`, `ENV_ID` and the session in `CINNA_SESSION_CONTEXT_PATH` (default `./session_context.json`); the backend checks the session belongs to this environment's agent and owner.
 - `reply TASK_ID --result-id ID --message M` — answer a blocked question.
 - `--json` (after the subcommand) prints `{"result": "ok", "delegation": {…}}`.
@@ -590,6 +590,25 @@ cinna delegation report --status done --summary 'Finished'     # inside the clou
 
 Inside cloud tasks, cinna-core's MCP task server also offers a `handover_report` tool for the same report.
 
+### `cinna artifacts publish | list | show | open | download | share | link | delete`
+
+Publish a folder or a file to Cinna as an **artifact** — a frozen, versioned copy people open on a Cinna page (a folder with `index.html` runs as a sandboxed static site; other files open in viewers). Run from the account workspace. Every verb first checks the server's artifacts capability and refuses with "This Cinna server does not support artifacts" when it is missing.
+
+- `publish PATH [--title T] [--description D] [--entry index.html] [--note N]` — zips the path and prints the page link. `.git/`, `.env*`, `credentials/`, `app-data/`, `.claude/`, `.cinna/`, `node_modules/`, key files and symlinks are never uploaded; the command lists what it left out. Private until shared. Publishing the same path again adds a revision to the same artifact (same link) — the CLI remembers `path → id` in `.cinna/artifacts.json`; `--update ID` names the artifact, `--new` publishes a separate one.
+- `list [--shared]` · `show ID` (revisions, people, links) · `open ID` (browser) · `download ID [--rev N] [-o DIR]` (default `artifacts/<short-id>/`). Ids may be shortened to a unique prefix.
+- `share ID [--instance | --private] [--user EMAIL]… [--remove-user EMAIL]…` and `link create ID [--expires 7d|12h|2w|never] [--code] [--label L] [--rev N]` — **a person runs these, in a terminal**: they refuse under `--json`, `--no-input` or without a TTY (code `needs_person`), and the account workspace's `.claude/settings.json` denies them to Claude Code. `link create` prints the link (and code) once.
+- `link revoke ID LINK` (link id or token prefix, from `show`) · `delete ID` — both confirm; `--yes` is required with `--json`.
+- `--json` (after the subcommand): NDJSON progress lines, then `{"result": "ok", "artifact_id", "action", "revision", "url", "excluded", …}`.
+
+```bash
+cinna artifacts publish ./reports/q3 --title "Q3 churn"
+cinna artifacts publish ./reports/q3            # revision 2, same link
+cinna artifacts share 3fa85f64 --user bob@example.com
+cinna artifacts link create 3fa85f64 --expires 7d --code
+```
+
+The printed page link is a valid `link` artifact for `cinna delegation report --artifact`.
+
 ### `cinna dev`
 
 Start a foreground dev session — creates / resumes the Mutagen sync session for this workspace and attaches the terminal to a two-tab TUI (status + raw Mutagen details). Ctrl-C terminates the session; sync does not outlive the TUI. To observe sync from another terminal without affecting it, use `cinna sync status`.

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/README.md

@@ -538,7 +538,7 @@ Hand work to a remote agent as a **durable delegation** — a platform task with
 
 - `create --id KEY --target AGENT_UUID --title T --brief B [--execute]` — the identity is `--target` + `--id`: a retry with the same pair returns the original task (changed title/brief are ignored) and never launches execution twice (the backend deduplicates). Prints the backend **task id** the other commands take, and whether it executes. `--depth 2 --root ROOT` makes a sub-delegation (`--root` is required at depth 2, not allowed at depth 1); `--group` tags related work.
 - `status TASK_ID` — one read: state, latest result, and any open question with its result id. A requester agent should end its turn and let Cinna Desktop deliver the result rather than poll.
-- `report [TASK_ID] --status in_progress|blocked|done|failed --summary S` — `blocked` needs `--question`; `--audience user` when a human must decide (default `requester`). `--artifact` (repeatable) is a JSON object with non-empty `kind` (backend accepts `file` or `link`), `name` and an `http(s)` `ref` — upload local files separately. `--body` adds detail.
+- `report [TASK_ID] --status in_progress|blocked|done|failed --summary S` — `blocked` needs `--question`; `--audience user` when a human must decide (default `requester`). `--artifact` (repeatable) is a JSON object with non-empty `kind` (backend accepts `file` or `link`), `name` and an `http(s)` `ref` — upload local files separately (`cinna artifacts publish` prints such a link). `--body` adds detail.
 - **Inside a cloud task**, omit `TASK_ID`: the report goes to the current task using `AGENT_AUTH_TOKEN`, `BACKEND_URL`, `ENV_ID` and the session in `CINNA_SESSION_CONTEXT_PATH` (default `./session_context.json`); the backend checks the session belongs to this environment's agent and owner.
 - `reply TASK_ID --result-id ID --message M` — answer a blocked question.
 - `--json` (after the subcommand) prints `{"result": "ok", "delegation": {…}}`.
@@ -553,6 +553,25 @@ cinna delegation report --status done --summary 'Finished'     # inside the clou
 
 Inside cloud tasks, cinna-core's MCP task server also offers a `handover_report` tool for the same report.
 
+### `cinna artifacts publish | list | show | open | download | share | link | delete`
+
+Publish a folder or a file to Cinna as an **artifact** — a frozen, versioned copy people open on a Cinna page (a folder with `index.html` runs as a sandboxed static site; other files open in viewers). Run from the account workspace. Every verb first checks the server's artifacts capability and refuses with "This Cinna server does not support artifacts" when it is missing.
+
+- `publish PATH [--title T] [--description D] [--entry index.html] [--note N]` — zips the path and prints the page link. `.git/`, `.env*`, `credentials/`, `app-data/`, `.claude/`, `.cinna/`, `node_modules/`, key files and symlinks are never uploaded; the command lists what it left out. Private until shared. Publishing the same path again adds a revision to the same artifact (same link) — the CLI remembers `path → id` in `.cinna/artifacts.json`; `--update ID` names the artifact, `--new` publishes a separate one.
+- `list [--shared]` · `show ID` (revisions, people, links) · `open ID` (browser) · `download ID [--rev N] [-o DIR]` (default `artifacts/<short-id>/`). Ids may be shortened to a unique prefix.
+- `share ID [--instance | --private] [--user EMAIL]… [--remove-user EMAIL]…` and `link create ID [--expires 7d|12h|2w|never] [--code] [--label L] [--rev N]` — **a person runs these, in a terminal**: they refuse under `--json`, `--no-input` or without a TTY (code `needs_person`), and the account workspace's `.claude/settings.json` denies them to Claude Code. `link create` prints the link (and code) once.
+- `link revoke ID LINK` (link id or token prefix, from `show`) · `delete ID` — both confirm; `--yes` is required with `--json`.
+- `--json` (after the subcommand): NDJSON progress lines, then `{"result": "ok", "artifact_id", "action", "revision", "url", "excluded", …}`.
+
+```bash
+cinna artifacts publish ./reports/q3 --title "Q3 churn"
+cinna artifacts publish ./reports/q3            # revision 2, same link
+cinna artifacts share 3fa85f64 --user bob@example.com
+cinna artifacts link create 3fa85f64 --expires 7d --code
+```
+
+The printed page link is a valid `link` artifact for `cinna delegation report --artifact`.
+
 ### `cinna dev`
 
 Start a foreground dev session — creates / resumes the Mutagen sync session for this workspace and attaches the terminal to a two-tab TUI (status + raw Mutagen details). Ctrl-C terminates the session; sync does not outlive the TUI. To observe sync from another terminal without affecting it, use `cinna sync status`.

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/docs/README.md

@@ -297,6 +297,7 @@ authoring convention.
 | **MCP integration** | `cinna connect mcp` · `cinna mcp-proxy` (knowledge stdio server) | [business](features/mcp_integration/mcp_integration.md) · [tech](features/mcp_integration/mcp_integration_tech.md) · [acceptance](features/mcp_integration/mcp_integration_acceptance.md) |
 | **Git versioning** | `cinna git` (link, status, commit, push, pull, log, checkout, unlink) — external remotes with your own credentials, `cinna` remotes with the CLI token | [business](features/git_versioning/git_versioning.md) · [tech](features/git_versioning/git_versioning_tech.md) · [acceptance](features/git_versioning/git_versioning_acceptance.md) |
 | **Durable delegation** | `cinna delegation` (create — idempotent per target + `--id`, status, report — owner side with a task id or from inside a cloud task, reply), gated on the backend capability version | [business](features/delegation/delegation.md) · [tech](features/delegation/delegation_tech.md) · [acceptance](features/delegation/delegation_acceptance.md) |
+| **Artifacts** | `cinna artifacts` (publish — republishes a remembered path, `--new` / `--update`; list, show, open, download, share and link create — person-only, refused without a TTY; link revoke, delete), gated on the server's artifacts capability | [business](features/artifacts/artifacts.md) · [tech](features/artifacts/artifacts_tech.md) · [acceptance](features/artifacts/artifacts_acceptance.md) |
 | **Improvement requests** | `cinna improve` (list, show, download, status) | [business](features/improvement_requests/improvement_requests.md) · [tech](features/improvement_requests/improvement_requests_tech.md) · [acceptance](features/improvement_requests/improvement_requests_acceptance.md) |
 | **Local agent import** | `cinna agent import` (Local Agent Kit → cloud agent), incl. the versioned folder contract (`.cinna-kit/layout.json`), `publications.json` and `content_hash` | [business](features/local_agent_import/local_agent_import.md) · [tech](features/local_agent_import/local_agent_import_tech.md) · [acceptance](features/local_agent_import/local_agent_import_acceptance.md) |
 | **Team library** | `cinna library` (list, get, share, update, status, grants, suggest) — kit folders in `Local/<slug>/` shared through cinna-core-hosted git with the account token; `cinna agent import --from-library` | [business](features/team_library/team_library.md) · [tech](features/team_library/team_library_tech.md) · [acceptance](features/team_library/team_library_acceptance.md) |

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/docs/features/account_workspace/account_workspace.md

@@ -219,7 +219,9 @@ each with its own token, registry entry, and Mutagen session.
   orchestrator/child `CLAUDE.md` regeneration is offline and per-workspace, so one
   unreadable child never aborts the rest.
 - **User-edited config is preserved.** `.claude/settings.json` is create-if-absent
-  (never clobbered on refresh); `.mcp.json` / `opencode.json` and the generated
+  (never clobbered on refresh; an existing file only gains the two `deny` rules
+  that keep `cinna artifacts share` / `link create` away from Claude Code — see
+  [Artifacts](../artifacts/artifacts.md)); `.mcp.json` / `opencode.json` and the generated
   `CLAUDE.md` are auto-generated infra and are overwritten.
 - **Child checkouts are standard.** A synced child is identical to a `cinna setup`
   checkout — same Model-A layout, same auto-link when git-versioned, same

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/docs/features/account_workspace/account_workspace_acceptance.md

@@ -53,7 +53,9 @@ the silent-secret and scope-drift bugs live.
   `account_token` / `platform_url` / `frontend_url` / `machine_name`; an empty
   `agents/` dir; an orchestrator `CLAUDE.md` (contains "Account Workspace");
   `.claude/settings.json` with `permissions.allow == ["Bash(cinna:*)",
-  "mcp__platform-knowledge"]` and `enableAllProjectMcpServers: true`; `.mcp.json`
+  "mcp__platform-knowledge"]`, `permissions.deny == ["Bash(cinna artifacts
+  share:*)", "Bash(cinna artifacts link create:*)"]` and
+  `enableAllProjectMcpServers: true`; `.mcp.json`
   + `opencode.json` pointing the proxy at `.cinna/account.json` via
   `CINNA_ACCOUNT_CONFIG`; a `context/` tree; and the next-step hints
   (`cinna account agents`, `cinna agent sync`).
@@ -226,7 +228,8 @@ the silent-secret and scope-drift bugs live.
 - **Expected:** `context/` is replaced (old-only files gone); the orchestrator
   `CLAUDE.md`, `.mcp.json`/`opencode.json`, and **every** synced child's
   per-agent `CLAUDE.md` are regenerated from the bundled templates; a
-  user-edited `.claude/settings.json` is left untouched; the run reports how many
+  user-edited `.claude/settings.json` keeps every entry and only gains the
+  artifact `deny` rules it lacks; the run reports how many
   child workspaces were regenerated.
 - **Watch for (non-destructive rule):** simulate a download failure (point at an
   unreachable platform) and confirm the **old `context/` survives** and the
@@ -388,7 +391,8 @@ the silent-secret and scope-drift bugs live.
 - **Single-use setup token is never burned on a doomed run** — guards precede the
   exchange.
 - **No silent clobber** — `refresh-context` removes the old `context/` only after
-  a successful download; user-edited `.claude/settings.json` is never overwritten.
+  a successful download; user-edited `.claude/settings.json` is never overwritten
+  (only the missing artifact `deny` rules are merged in).
 - **No state drift between commands** — a synced child is a standard per-agent
   workspace (registry + config) indistinguishable from `cinna setup`; the active
   user workspace is the single source for both the listing scope and the create

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/docs/features/account_workspace/account_workspace_tech.md

@@ -344,7 +344,9 @@ All consumed by `src/cinna/client.py:AccountClient` with the account token
   `CLAUDE.md` regeneration is independent of the download.
   (`tests/test_account.py:test_refresh_context_failure_preserves_old_tree`)
 - **Settings is create-if-absent** — `_write_account_claude_settings` never
-  clobbers a user-edited `.claude/settings.json`.
+  clobbers a user-edited `.claude/settings.json`; it only appends the missing
+  `artifacts.person_only_deny_rules()` to `permissions.deny`, and leaves a file
+  that is not a JSON object alone.
   (`tests/test_account.py:test_refresh_context_preserves_user_claude_settings`)
 - **Per-agent URL is rejected** — `parse_account_setup_input` must not silently
   accept a `/cli-setup/<token>` (non-account) URL.

cinna_cli-0.5.3/docs/features/artifacts/artifacts.md

@@ -0,0 +1,138 @@
+# Artifacts (`cinna artifacts`)
+
+## Purpose
+
+Publish a folder or a file from the user's machine to cinna-core as an
+**artifact** — a frozen, versioned copy people open on a Cinna page — and get a
+link back. The same command group lists, downloads, opens, shares and deletes
+artifacts from a terminal.
+
+## Mental model / core concepts
+
+An artifact lives **in cinna-core**, not on the machine and not in an agent
+environment. The CLI is a publisher and a remote control; once published, the
+artifact outlives the folder, the agent and the session it came from.
+
+- **Artifact** — a stable identity (title, who can see it, its page link) over a
+  sequence of immutable **revisions**. Core renders it: a folder with an
+  `index.html` runs as a small static site in a sandbox; anything else is a file
+  set with viewers (Markdown, CSV, PDF, images, code). Not to be confused with a
+  delegation's `--artifact` — a link attached to a task result (see Integration
+  points).
+- **Revision** — one publish of the files. Republishing adds a revision; the
+  page link stays the same and shows the latest one, so a shared link never
+  breaks when a report is refreshed.
+- **Path memory** — the CLI remembers which artifact each local path was
+  published as, per account workspace (`.cinna/artifacts.json`), and republishes
+  into it. Nothing is ever written into the published folder itself.
+- **Exclusions** — what never leaves the machine: `.git/`, `.env*` and `*.env`,
+  `credentials/`, `credentials.json`, `app-data/`, `.claude/`, `.cinna/` (it
+  holds the account token), `node_modules/`, `__pycache__/`, key and token
+  files (`*.pem`, `*.key`, `*.p12`, `id_rsa*` and the other SSH key names,
+  `.netrc`, `.npmrc`, `.pypirc`), `.DS_Store`, and every symlink. Mandatory, not
+  advisory; core drops its own set again on its side.
+- **Who can see it** — "Only you" (private, the default), plus named people,
+  plus "Everyone on the instance", plus **public links** (anyone holding the
+  link, signed out; optional expiry, optional 4-digit code, revocable,
+  optionally pinned to a revision). The CLI never says "public" for
+  instance-wide.
+- **Agents publish, people share** — an agent in the account workspace may
+  publish (always private) and manage its artifacts, but widening who can see
+  one is the user's call: `share` and `link create` are person-only verbs.
+
+## User flows
+
+### Publish a report and get its link
+1. `cinna artifacts publish ./reports/q3 --title "Q3 churn"` from the account
+   workspace (or any folder below it).
+2. The CLI prints the file count and size, then what it left out
+   (`.git/`, `.env`, …), uploads, and prints the page link and the id.
+3. The artifact is private; the user opens the link (or
+   `cinna artifacts open <id>`) to check it.
+
+### Refresh it later, same link
+4. Run the same `cinna artifacts publish ./reports/q3` again. The CLI says it
+   republished — revision 2, same link — because it remembered the path.
+5. `--update <id>` republishes into a named artifact instead; `--new` publishes
+   a separate artifact even though the path is known (the path then points at
+   the new one).
+
+### Share it with people
+6. In their own terminal the user runs
+   `cinna artifacts share <id> --user bob@example.com` and/or `--instance`;
+   `--private` and `--remove-user` narrow it again. The CLI prints who can see
+   it afterwards.
+7. For someone outside the instance:
+   `cinna artifacts link create <id> [--expires 7d] [--code] [--label …] [--rev N]`
+   prints the link (and code) **once**. `cinna artifacts show <id>` lists links
+   by id and prefix; `cinna artifacts link revoke <id> <link>` kills one.
+
+### Find, fetch, remove
+8. `cinna artifacts list` (yours) or `list --shared` (shared with you);
+   `show <id>` for revisions, people and links.
+9. `cinna artifacts download <id> [--rev N] [-o DIR]` extracts the files
+   (default `artifacts/<short-id>/` under the account root).
+10. `cinna artifacts delete <id>` asks first; the page and every link stop
+    working at once.
+
+## Business rules
+
+- **Server support first** — every verb asks core for its artifacts capability
+  before anything else; a server without it (or with another version) gets
+  "This Cinna server does not support artifacts" and nothing is uploaded.
+- **A secret path named directly is refused** — publishing `.cinna/account.json`,
+  a `credentials/` folder or anything inside an excluded folder stops before
+  any request; the walk alone would only see paths below what was named.
+- **Exclusions are listed, always** — the human output and the `--json` result
+  name every path left out, the CLI's and the server's together.
+- **Refuse what core would refuse, before uploading** — over the file count,
+  per-file size or total size the server advertises, the CLI stops locally.
+- **Republish keeps the title** — on a republish only the flags the user passes
+  change (`--title`, `--description`, `--entry`, `--note`).
+- **A remembered artifact that was deleted** — the CLI says so and publishes a
+  new one; an explicit `--update <id>` that no longer exists fails instead.
+- **Person-only verbs (A8)** — `share` and `link create` refuse under `--json`,
+  `--no-input` / `CINNA_NO_INPUT`, or when stdin is not a terminal, with code
+  `needs_person`. There is no `--yes` bypass: an agent can pass any flag. The
+  generated `.claude/settings.json` also denies `Bash(cinna artifacts share:*)`
+  and `Bash(cinna artifacts link create:*)` to Claude Code. The CLI cannot tell
+  an agent from a person — this is a speed bump; core enforces A8 on its
+  agent-token route.
+- **A script cannot share either** — a script without a terminal is refused the
+  same way. Sharing from automation is deliberately not offered in v1; the web
+  page's Share dialog is the alternative.
+- **Destructive verbs confirm** — `delete` and `link revoke` ask (default No);
+  under `--json` they need `--yes`, under `--no-input` without `--yes` they
+  abort.
+- **The link token is shown once** — core returns it only on creation; the
+  api-proxy never relays it, and `show` lists links by prefix only.
+- **Owner-only writes** — share, link and delete check ownership first and say
+  so plainly rather than relaying a 404.
+
+## Architecture overview
+
+```
+cinna artifacts publish PATH
+  → artifacts.py: walk + exclusions → temp zip (stored entries for very compressible files)
+  → AccountClient → POST /cli/account/artifacts[/{id}/revisions]  (multipart, account token)
+  → .cinna/artifacts.json  (path → artifact id)
+
+cinna artifacts list|show|share|link revoke|delete
+  → AccountClient → api-proxy → /api/v1/artifacts…, /users/search
+
+cinna artifacts link create | download
+  → AccountClient → /cli/account/artifacts/{id}/links | /download
+```
+
+## Integration points
+
+- [Account workspace](../account_workspace/account_workspace.md) — the account
+  token, the active user workspace the artifact lands in, and the generated
+  `.claude/settings.json` that carries the deny rules.
+- [Durable delegation](../delegation/delegation.md) — the page link a publish
+  prints is a valid `link` artifact for
+  `cinna delegation report --artifact '{"kind":"link","name":"…","ref":"<url>"}'`.
+- `cinna api` — the generic api-proxy the JSON verbs ride; it refuses link
+  creation and blanks link codes, which is why `link create` has its own route.
+- cinna-core's kit skill `cinna-artifacts` — how to build a folder that works
+  in the sandbox (bundle libraries, no `localStorage`, relative paths).

cinna_cli-0.5.3/docs/features/artifacts/artifacts_acceptance.md

@@ -0,0 +1,140 @@
+# Artifacts — Acceptance Scenarios
+
+## Preconditions
+
+- A live cinna-core with artifacts (`curl -s $PLATFORM/.well-known/cinna-desktop`
+  shows `"artifacts": 1`) and the frontend reachable for the printed links.
+- An account workspace (`cinna account setup …`) whose token is valid
+  (`cinna account status`).
+- A second user on the same instance (for `--user` and `--shared`).
+- The editable install: `which cinna` resolves to this repo's `src/cinna`
+  (or `uv run --project <repo> cinna`).
+- A real terminal for scenarios 6–8 — or `script -q /dev/null cinna …` to give
+  the command a pseudo-terminal.
+- A test folder:
+
+```bash
+mkdir -p /tmp/art/report/.git /tmp/art/report/sub && cd /tmp/art/report
+echo '<h1>Q3</h1><script src="app.js"></script>' > index.html
+echo 'console.log(1)' > app.js
+printf 'a,b\n1,2\n' > sub/data.csv
+echo 'SECRET=1' > .env
+echo '[core]' > .git/config
+ln -sf /etc/hosts hosts-link
+```
+
+## Scenario catalog
+
+### 1. Publish prints a link that opens in core
+- **Goal:** a folder becomes a private artifact with a page.
+- **Setup:** no `.cinna/artifacts.json` entry for `/tmp/art/report`.
+- **Steps:**
+  ```bash
+  cinna artifacts publish /tmp/art/report --title "Q3 churn"
+  ```
+- **Expected:** "Publishing … (4 files …)", "Left out 3 paths (never
+  published): .git/, .env, hosts-link", "Published Q3 churn — site, revision 1,
+  only you can see it", the `/artifact/<id>` link and the id. The link opens
+  the page; the site renders.
+- **Watch for:** a root-level `.git/` reaching core (it was once listed under
+  "The server also left out", meaning it was uploaded).
+
+### 2. Excluded files are absent from core's revision
+- **Goal:** secrets never leave the machine.
+- **Steps:**
+  ```bash
+  cinna artifacts download <id> -o /tmp/art/dl && find /tmp/art/dl -type f
+  ```
+- **Expected:** `index.html`, `app.js`, `sub/data.csv` only — no `.env`,
+  `.git/config`, `hosts-link`.
+
+### 3. Republish without an id, then `--new`
+- **Goal:** refreshing keeps the link (A12).
+- **Steps:**
+  ```bash
+  echo 'console.log(2)' > /tmp/art/report/app.js
+  cinna artifacts publish /tmp/art/report
+  cinna artifacts publish /tmp/art/report --new
+  cinna artifacts list
+  ```
+- **Expected:** the second command says "Republished … as revision 2 — same
+  link (remembered …)" with the same id; the third creates a second artifact;
+  `list` shows both. A further plain publish republishes the newer one.
+- **Watch for:** a republish that changes the title when `--title` was not
+  passed; a duplicate artifact instead of revision 2.
+
+### 4. `--json` emits NDJSON ending in the result line
+- **Steps:**
+  ```bash
+  cinna artifacts publish /tmp/art/report --json
+  ```
+- **Expected:** `{"status": …}` progress lines, then one
+  `{"result": "ok", "artifact_id", "action", "revision", "url", "excluded", …}`
+  line, nothing else on stdout.
+
+### 5. A deleted remembered artifact
+- **Steps:**
+  ```bash
+  cinna artifacts delete <id> --json --yes
+  cinna artifacts publish /tmp/art/report
+  ```
+- **Expected:** if the deleted id was the remembered one, publish creates a new
+  artifact (revision 1). With `--update <deleted id>` it fails with the
+  server's 404 instead.
+
+### 6. Share and link refuse without a person
+- **Steps:**
+  ```bash
+  cinna artifacts share <id> --instance --json
+  cinna artifacts share <id> --instance --no-input
+  echo | cinna artifacts link create <id>
+  ```
+- **Expected:** each exits 1 with code `needs_person` and no change on the
+  artifact page.
+
+### 7. Share and link work in a terminal
+- **Steps (in a terminal):**
+  ```bash
+  cinna artifacts share <id> --instance --user second-user@example.com
+  cinna artifacts link create <id> --code --label "for bob" --rev 1
+  curl -s $PLATFORM/api/v1/artifact-links/<token>/info
+  cinna artifacts show <id>
+  cinna artifacts link revoke <id> <link id or prefix> --yes
+  ```
+- **Expected:** share prints "Everyone on the instance + 1 person"; the second
+  user sees it under `list --shared`. Link create prints the `/s/<token>` link,
+  the code and the expiry once; `info` reports `needs_code: true`. `show` lists
+  the link as `<id>  <prefix>… for bob — works until … [code, pinned to rev 1]`.
+  After revoke, `info` answers "Link not found".
+
+### 8. Claude Code cannot run the share verbs
+- **Setup:** `cinna account refresh-context`; `.claude/settings.json` holds the
+  two `deny` rules.
+- **Steps:** from the account root
+  ```bash
+  claude -p "Run with the Bash tool: cinna artifacts share <id> --private, then cinna artifacts link create <id>. Quote any error."
+  ```
+- **Expected:** both are refused with "Permission to use Bash with command … has
+  been denied".
+
+### 9. Older core
+- **Setup:** a core without the artifacts routes (or temporarily point the
+  workspace at one).
+- **Steps:** `cinna artifacts list --json`
+- **Expected:** `{"result": "error", "code": "artifacts_unsupported", …}`.
+
+## Cross-cutting invariants
+
+- Nothing in the A10 list, nor `.cinna/`, is ever in an uploaded zip.
+- No file is written into the published folder; the path memory lives in the
+  account's `.cinna/`.
+- The link token appears only in `link create`'s output.
+- Under `--json` stdout carries JSON lines only, ending in one `result` line.
+- No person-only verb succeeds under `--json`, `--no-input` or without a TTY.
+
+## Cleanup
+
+```bash
+cinna artifacts list --json | jq -r '.artifacts[].id' | xargs -n1 -I{} cinna artifacts delete {} --json --yes
+rm -rf /tmp/art
+```

cinna_cli-0.5.3/docs/features/artifacts/artifacts_tech.md

@@ -0,0 +1,124 @@
+# Artifacts — Technical Details
+
+## File locations
+
+- `src/cinna/artifacts.py` — the `cinna artifacts` Click group, the exclusion
+  list and walk, the zip writer, the path memory, the person-only guard.
+- `src/cinna/client.py` — `AccountClient` artifact methods (api-proxy JSON verbs
+  and the dedicated multipart / download / link routes).
+- `src/cinna/main.py` — wires the group with `cli.add_command` and attaches
+  `--json` / `--no-input` to every leaf (`_attach_driver_options()`).
+- `src/cinna/account.py:_write_account_claude_settings()` — writes or merges the
+  Claude Code deny rules.
+- `src/cinna/templates/ACCOUNT_CLAUDE.md.template` — the orchestrator guide's
+  "Artifacts" table.
+- `tests/test_artifacts.py` — exclusions, the archive writer, memory, the guard,
+  every verb against a respx-mocked platform; `tests/test_account.py` — the
+  settings deny rules.
+
+## Command surface
+
+- `cinna artifacts publish` — `src/cinna/artifacts.py:publish()`
+- `cinna artifacts list` — `src/cinna/artifacts.py:list_cmd()`
+- `cinna artifacts show` — `src/cinna/artifacts.py:show()`
+- `cinna artifacts open` — `src/cinna/artifacts.py:open_cmd()`
+- `cinna artifacts download` — `src/cinna/artifacts.py:download()`
+- `cinna artifacts share` — `src/cinna/artifacts.py:share()`
+- `cinna artifacts link create` — `src/cinna/artifacts.py:link_create()`
+- `cinna artifacts link revoke` — `src/cinna/artifacts.py:link_revoke()`
+- `cinna artifacts delete` — `src/cinna/artifacts.py:delete()`
+
+## Key functions & flow
+
+- `src/cinna/artifacts.py:_session()` — loads the account config, opens an
+  `AccountClient`, calls `get_artifacts_capabilities()`; 404/405 or a version
+  other than `SUPPORTED_VERSION` raises `_unsupported()` (code
+  `artifacts_unsupported`). Yields `_Session` with the capabilities' `limits`.
+- `src/cinna/artifacts.py:refuse_excluded_source()` — every segment of the
+  resolved path is checked against the exclusions before the walk.
+- `src/cinna/artifacts.py:collect_files()` — `os.walk(followlinks=False)`;
+  prunes excluded directories (recorded as `name/`), records symlinks and
+  special files; a single file is published under its own name.
+- `src/cinna/artifacts.py:is_artifact_excluded()` — `kit_contract.is_excluded()`
+  over the casefolded path against `ARTIFACT_EXCLUDE`.
+- `src/cinna/artifacts.py:_check_limits()` — file count, per-file and total size
+  against the advertised limits, before zipping.
+- `src/cinna/artifacts.py:write_archive()` — zip into a temp dir;
+  `_deflate_ratio()` decides per entry whether to store instead of deflate.
+- `src/cinna/artifacts.py:ArtifactMemory` — `lookup()` / `remember()` /
+  `forget()` over `.cinna/artifacts.json`.
+- `src/cinna/artifacts.py:_list_all()` — pages `list_artifacts()` (200 per
+  page, the server's cap) until `count` is reached; used by `list` and by
+  `src/cinna/artifacts.py:_resolve_id()`, where a full UUID passes through and a
+  prefix is matched against both scopes.
+- `src/cinna/artifacts.py:require_person()` / `person_only_deny_rules()` — both
+  read `PERSON_ONLY_VERBS`.
+- `src/cinna/artifacts.py:_user_id_for()` — exact (casefolded) email match over
+  the fuzzy `search_users()` result (25, the server's cap). `share
+  --remove-user` falls back to it when a grant carries no email.
+- `src/cinna/artifacts.py:parse_expiry()` — `12h` / `7d` / `2w` / `never`.
+- `src/cinna/artifacts.py:extract_archive()` — refuses absolute paths, `..`,
+  symlink entries and anything resolving outside the destination; every entry is
+  checked before the first is written, so a refusal leaves nothing behind.
+
+## Config & registry
+
+- `.cinna/artifacts.json` in the account root <!-- nocheck --> —
+  `{"version": 1, "published": {"<absolute path>": {artifact_id, platform_url,
+  title, published_at}}}`. Written atomically (temp file + replace). An entry
+  whose `platform_url` differs from the workspace's is ignored.
+- `.claude/settings.json` in the account root <!-- nocheck --> —
+  `permissions.deny` gains `Bash(cinna artifacts share:*)` and
+  `Bash(cinna artifacts link create:*)`.
+- Nothing is written to `.cinna/config.json` or the per-user agent registry.
+
+## External contracts
+
+- `GET /api/v1/artifacts/capabilities` (api-proxy) — `{version: 1, limits:
+  {max_revision_bytes, max_revision_files, max_file_bytes, user_quota_bytes}}`.
+- `POST /api/v1/cli/account/artifacts` — multipart `archive` + `title`,
+  `description`, `entry_path`, `source_kind=cli`, `source_label`
+  (`<machine> · <folder>`), `user_workspace_id` → `ArtifactPublished`
+  (`id`, `url`, `revision_number`, `kind`, `excluded`, …).
+- `POST /api/v1/cli/account/artifacts/{id}/revisions` — multipart `archive` +
+  optional `title`, `description`, `entry_path`, `note`; owner only.
+- `GET /api/v1/cli/account/artifacts/{id}/download?rev=` — zip, streamed to a
+  temp file.
+- `POST /api/v1/cli/account/artifacts/{id}/links` — `{label, expires_at,
+  with_code, pinned_revision_id}` → `ArtifactLinkCreated` with `token`, `url`,
+  `code`.
+- api-proxy: `GET artifacts?scope=mine|shared_with_me`, `GET artifacts/{id}`
+  (links' `code` blanked by the proxy), `PATCH artifacts/{id}` (`visibility`),
+  `PUT artifacts/{id}/grants` (full list of `{principal: {user_id}, access:
+  "view"}`), `DELETE artifacts/{id}/links/{link_id}`, `DELETE artifacts/{id}`,
+  `GET users/search?q=&include_self=true`. The proxy refuses
+  `POST artifacts/{id}/links`.
+- Core's ingest rejects a zip entry whose compression ratio exceeds
+  `ARTIFACT_MAX_COMPRESSION_RATIO` (100 by default) — the CLI's 50 threshold
+  keeps under it.
+
+## Edge cases & guardrails
+
+- The kit pattern engine's `**/` does not match zero segments in front of a
+  folder pattern, so `ARTIFACT_EXCLUDE` lists every name both bare and under
+  `**/` (`src/cinna/artifacts.py:_EXCLUDED_ANYWHERE`). Found live: `.git/` at
+  the root reached core before this.
+- `ARTIFACT_EXCLUDE` is not `kit_contract.DEFAULT_EXCLUDE`: that list drops
+  `README.md`, `CLAUDE.md` and `temp/`, which are legitimate artifact content.
+- The memory key is `Path.resolve()` of the argument, so `./q3`, `q3/` and an
+  absolute path are the same source.
+- A 404 on a republish from memory forgets the entry and creates
+  (`publish()`); the same 404 on `--update` propagates.
+- `require_person()` reads `console.json_mode`, `console.no_input` and
+  `_stdin_is_tty()` (patchable in tests); the root `--no-input`, the per-command
+  `--no-input` and `CINNA_NO_INPUT` all set `console.no_input`.
+- Claude Code deny rules match by command prefix, so `cinna artifacts --json
+  share …` or `cinna -v artifacts share …` pass them; those are refused by
+  `require_person()` (Claude Code's Bash tool has no TTY on stdin). Verified
+  with `claude -p` in a generated workspace: the two prefixes report
+  "Permission … has been denied".
+- `_write_account_claude_settings()` merges only into a JSON object whose
+  `permissions` / `deny` are an object / list; anything else is left untouched.
+  A user who deletes the rules gets them back on the next `refresh-context`.
+- Rich markup in server text is escaped (`escape()`), including the
+  `[code, pinned to rev N]` tag of a link line.

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/docs/features/delegation/delegation.md

@@ -109,7 +109,8 @@ remote control over it; nothing is written to the workspace.
   with a non-empty `kind`, a non-empty `name`, and an `http(s)` `ref`. The CLI
   checks only that shape; the backend further restricts `kind` (currently
   `file` or `link`). Local files must be uploaded separately first; the CLI
-  never uploads them.
+  never uploads them. `cinna artifacts publish` is the way to do that: the page
+  link it prints is a valid `link` ref (see [Artifacts](../artifacts/artifacts.md)).
 - **Executor report is session-bound** — without a task id, `report` needs the
   environment's agent token, backend URL and environment id, plus the current
   session context. Missing any of them is a hard failure. The backend verifies

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cinna-cli"
-version = "0.5.2"
+version = "0.5.3"
 description = "Local development CLI for Cinna Core agents"
 readme = "README.md"
 requires-python = ">=3.10"

{cinna_cli-0.5.2 → cinna_cli-0.5.3}/src/cinna/account.py

@@ -795,17 +795,44 @@ def _write_account_claude_settings(account_root: Path) -> None:
     Code doesn't prompt "New MCP server found in this project" on first launch,
     and the ``mcp__platform-knowledge`` allow rule pre-approves that server's
     tool calls (e.g. ``knowledge_query``) so each invocation doesn't prompt.
+    The ``deny`` rules keep the person-only artifact verbs (``share``, ``link
+    create``) away from Claude Code even under the ``Bash(cinna:*)`` allow
+    (A8: agents publish, people share; the verbs also refuse without a TTY).
+
     Create-if-absent: never clobbers a user's own edits (so it is safe to call
-    again from ``refresh-context``).
+    again from ``refresh-context``). An existing file only gains the deny rules
+    it lacks; one that is not a JSON object is left alone.
     """
+    from cinna.artifacts import person_only_deny_rules
+
+    deny = person_only_deny_rules()
     settings_path = account_root / ".claude" / "settings.json"
     if settings_path.exists():
+        try:
+            settings = json.loads(settings_path.read_text())
+        except (OSError, ValueError):
+            return
+        permissions = settings.get("permissions") if isinstance(settings, dict) else None
+        if permissions is None and isinstance(settings, dict):
+            permissions = settings["permissions"] = {}
+        if not isinstance(permissions, dict):
+            return
+        existing = permissions.get("deny")
+        if existing is None:
+            existing = permissions["deny"] = []
+        if not isinstance(existing, list):
+            return
+        missing = [rule for rule in deny if rule not in existing]
+        if missing:
+            existing.extend(missing)
+            settings_path.write_text(json.dumps(settings, indent=2) + "\n")
         return
     settings_path.parent.mkdir(parents=True, exist_ok=True)
     settings = {
         "enableAllProjectMcpServers": True,
         "permissions": {
             "allow": ["Bash(cinna:*)", "mcp__platform-knowledge"],
+            "deny": deny,
         },
     }
     settings_path.write_text(json.dumps(settings, indent=2) + "\n")