uploads.sh changelog

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

− CLI's commands or flags change.+ CLI's commands or flags change. The hosted MCP also serves them as+ `skill://<name>/SKILL.md` (Skills extension, SEP-2640; `apps/mcp/src/skills.ts`),+ so a new root skill must be added there too.

https://uploads.sh/llms.txt

− - [Docs: REST API](https://uploads.sh/docs/api): call https://api.uploads.sh directly — bearer `up_`/`ups_` tokens and `files:*` scopes, a first upload with curl, `cursor` pagination, the error envelope, rate limits and `Idempotency-Key`, and a reference for every endpoint in /openapi.json− Enrollment invite pages (`/invite`) and the browser console (`/console`) are private operator surfaces. See https://uploads.sh/robots.txt.+ - [Docs: REST API](https://uploads.sh/docs/api): call https://api.uploads.sh directly — bearer `up_`/`ups_` tokens and `files:*` scopes, a first upload with curl, `cursor` pagination, the error envelope, rate limits and `Idempotency-Key`+ - [Docs: API reference](https://uploads.sh/docs/api/reference): every endpoint in /openapi.json with schemas and examples (rendered in the browser; fetch /openapi.json directly for the machine-readable spec)+ Enrollment invite pages (`/invite`) are private operator surfaces. See https://uploads.sh/robots.txt.

version

0.62.1 → 0.63.1

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

−   module-level request state, secrets never in config or source.+ Those hosted hosts are R2 custom domains, served through `uploads-read-gate`+ (`apps/read-gate`). A held image gets a "Held for review" card. Any other+ safety hold is a 404. Private-repo images stay cookie-less public reads. A+ bring-your-own bucket is not on this Worker. See+ [docs/ops.md](docs/ops.md#hosted-read-gate).+   module-level request state, secrets never in config or source. The+   `security-audit` skill from `cloudflare/security-audit-skill` is a project+   default (`package.json` `skills`). The canonical copy is `.agents/skills`.+   Claude Code symlinks to it. Grok, Codex, and Cursor read `.agents/skills`,+   so this repo keeps no `.grok` copy. Load it for a security audit, a+   vulnerability review, or a pen test. It stays out of the root `skills/`+   directory, so `uploads install` does not ship it. `skills-lock.json`+   records the installed copy.

version

0.61.1 → 0.62.1

version

0.60.2 → 0.61.1

version

0.60.1 → 0.60.2

version

0.60.0 → 0.60.1

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

− worker deploys normally happen via Workers Builds on push to main. For an− isolated branch environment, `npx wrangler preview` from an app directory —− playbook in [docs/previews.md](docs/previews.md); the Workers Builds bot's− "Branch Preview URL" on PRs is a different, legacy mechanism that runs− against production bindings.+ worker deploys still happen via Workers Builds on push to main. Pushing a+ branch does not preview `uploads-web`, `uploads-auth`, or `uploads-api`.+ `uploads-mcp`, `uploads-viewer`, and `uploads-slack` are unchanged. Do not+ upload a preview by default. The command is in+ [docs/previews.md](docs/previews.md#no-automatic-branch-preview).+ - **Use conventional-commit format for PR titles and commit messages**, e.g.+   `feat(slack): rewrite hold DMs once the hold ends` or `fix: …`. This applies to+   every commit you make, not only the squash title, and to cloud agents as much as+   local ones. Types and subject style are in CONTRIBUTING.md.

https://uploads.sh/llms.txt

− - [Docs: experimental AI labels](https://uploads.sh/docs/agents#experimental-ai-tags): Flagship-gated `ai.kind` / `ai.surface` / `ai.screen` / `ai.tags` / `ai.summary` after a REST put — read with `uploads meta get` or `uploads find ai.screen=login` (MCP `get_metadata` / `find_files`). Clients cannot set `ai.*`. Human `path` / `state` stay primary.+ - [Docs: Slack](https://uploads.sh/docs/slack): add the uploads.sh Slack app (Add to Slack at https://agents.uploads.sh/slack/install) for previews of public uploads.sh file, gallery, and live-link URLs; connect a Slack user to an uploads.sh account from the app's Home tab+ - [Docs: experimental AI labels](https://uploads.sh/docs/ai-labels): Flagship-gated `ai.kind` / `ai.surface` / `ai.screen` / `ai.tags` / `ai.summary` after a REST put — read with `uploads meta get` or `uploads find ai.screen=login` (MCP `get_metadata` / `find_files`). Clients cannot set `ai.*`. Human `path` / `state` stay primary. Internal flags `ai.rating` / `ai.content` / `ai.secret` / `ai.pii` (each with a `high` / `medium` / `low` `.confidence` key) are written on the same call and are not c+ - [Pricing](https://uploads.sh/pricing) (Markdown: https://uploads.sh/pricing.md): free plan, Pro for teams ($10/month intro), bring-your-own-bucket storage, fair use, and self-hosting as the fallback

version

0.59.6 → 0.60.0

version

0.59.3 → 0.59.6

version

0.59.2 → 0.59.3

version

0.59.1 → 0.59.2

version

0.58.0 → 0.59.1

version

0.57.1 → 0.58.0

https://uploads.sh/llms.txt

+ - [Docs: MCP server](https://uploads.sh/docs/mcp): connect to the hosted MCP at https://agents.uploads.sh/mcp, OAuth vs. workspace-token auth, scopes, branch staging then `promote`, hosted vs. local tool differences, and a parameter reference for every tool+ - [Docs: REST API](https://uploads.sh/docs/api): call https://api.uploads.sh directly — bearer `up_`/`ups_` tokens and `files:*` scopes, a first upload with curl, `cursor` pagination, the error envelope, rate limits and `Idempotency-Key`, and a reference for every endpoint in /openapi.json+ - Video player (public videos only): https://uploads.sh/player?url=<page-url>

version

0.57.0 → 0.57.1

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

− The Claude plugin is self-contained in `plugins/claude/uploads/` so the Claude− `.claude-plugin/marketplace.json` points `source` at it. Its `skills/` is a− generated copy of the root `skills/`, because a plugin can't reference files+ The agent plugin in `plugins/claude/uploads/` uses the common plugin layout+ (listed in the Claude Code marketplace; submitted to the xAI plugin+ marketplace as `uploads`, pending review). It is self-contained so the Claude+ `.claude-plugin/marketplace.json` points `source` at it. `.mcp.json` wraps+ the hosted server in `mcpServers` (Claude Code also loads the flat form; xAI's+ catalog scanner reads `mcpServers`). Its `skills/` is a generated copy of the+ root `skills/`, because a plugin can't reference files

https://uploads.sh/llms.txt

+ - [Docs: live links](https://uploads.sh/docs/feeds): a newest-first public page at /c/<id> of the files tagged with a repo or one PR/issue (`uploads feed create`, MCP `feed_create`; the CLI, API and MCP call it a feed); the managed PR comment links to its PR's live link

version

0.56.7 → 0.57.0

version

0.56.6 → 0.56.7

version

0.56.5 → 0.56.6