uploads.sh AGENTS.md changelog

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

− CLI's commands or flags change.+ CLI's commands or flags change. The hosted MCP also serves them as+ `skill://<name>/SKILL.md` (Skills extension, SEP-2640; `apps/mcp/src/skills.ts`),+ so a new root skill must be added there too.

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

−   module-level request state, secrets never in config or source.+ Those hosted hosts are R2 custom domains, served through `uploads-read-gate`+ (`apps/read-gate`). A held image gets a "Held for review" card. Any other+ safety hold is a 404. Private-repo images stay cookie-less public reads. A+ bring-your-own bucket is not on this Worker. See+ [docs/ops.md](docs/ops.md#hosted-read-gate).+   module-level request state, secrets never in config or source. The+   `security-audit` skill from `cloudflare/security-audit-skill` is a project+   default (`package.json` `skills`). The canonical copy is `.agents/skills`.+   Claude Code symlinks to it. Grok, Codex, and Cursor read `.agents/skills`,+   so this repo keeps no `.grok` copy. Load it for a security audit, a+   vulnerability review, or a pen test. It stays out of the root `skills/`+   directory, so `uploads install` does not ship it. `skills-lock.json`+   records the installed copy.

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

− worker deploys normally happen via Workers Builds on push to main. For an− isolated branch environment, `npx wrangler preview` from an app directory —− playbook in [docs/previews.md](docs/previews.md); the Workers Builds bot's− "Branch Preview URL" on PRs is a different, legacy mechanism that runs− against production bindings.+ worker deploys still happen via Workers Builds on push to main. Pushing a+ branch does not preview `uploads-web`, `uploads-auth`, or `uploads-api`.+ `uploads-mcp`, `uploads-viewer`, and `uploads-slack` are unchanged. Do not+ upload a preview by default. The command is in+ [docs/previews.md](docs/previews.md#no-automatic-branch-preview).+ - **Use conventional-commit format for PR titles and commit messages**, e.g.+   `feat(slack): rewrite hold DMs once the hold ends` or `fix: …`. This applies to+   every commit you make, not only the squash title, and to cloud agents as much as+   local ones. Types and subject style are in CONTRIBUTING.md.

https://raw.githubusercontent.com/buildinternet/uploads/HEAD/AGENTS.md

− The Claude plugin is self-contained in `plugins/claude/uploads/` so the Claude− `.claude-plugin/marketplace.json` points `source` at it. Its `skills/` is a− generated copy of the root `skills/`, because a plugin can't reference files+ The agent plugin in `plugins/claude/uploads/` uses the common plugin layout+ (listed in the Claude Code marketplace; submitted to the xAI plugin+ marketplace as `uploads`, pending review). It is self-contained so the Claude+ `.claude-plugin/marketplace.json` points `source` at it. `.mcp.json` wraps+ the hosted server in `mcpServers` (Claude Code also loads the flat form; xAI's+ catalog scanner reads `mcpServers`). Its `skills/` is a generated copy of the+ root `skills/`, because a plugin can't reference files