@sendartifact/cli

Publish a complete HTML page or static bundle to sendartifact.com. Keep the URL when you revise it.

Publish a static SPA

For Vite + React, set base: './' in your existing Vite config and rebuild (vite build --base=./ also works). Publish the complete dist folder. Bundled assets must use relative URLs such as ./assets/index.js: /assets/ resolves outside the artifact's versioned content path and returns 404. The API returns HTML/CSS path warnings and the CLI prints them on stderr; fix them before sharing. The scan skips JavaScript and files over 2 MB, so you still need to smoke-test the rendered app.

Content runs in an iframe without allow-same-origin. Accessing window.localStorage or window.sessionStorage can itself throw SecurityError. Wrap the property access and every read/write in try/catch, including React state initializers. Keep state in React or memory when storage is unavailable; it will not persist across reloads.

After publishing, open the shell URL in a browser, confirm React mounts, exercise controls, and reload. Resolve asset URLs against the iframe's actual src and check for 200 responses and correct content types. A successful publish or visible shell title does not prove the app rendered. Opening the content URL directly does not reproduce the iframe sandbox.

Anonymous first publish and iteration

npx @sendartifact/cli publish ./dist --anonymous
# → url, private claimUrl, expires (7 days)

Every anonymous publish creates a new URL. To iterate at one address, sign in using Setup below, then claim the first artifact with the saved API key:

npx @sendartifact/cli claim CLAIM_URL --slug my-app
npx @sendartifact/cli read my-app --out live-index.html
# Make your fix, rebuild dist, then update with the saved key:
npx @sendartifact/cli publish ./dist --slug my-app

Use the slug in the claim response URL on retries. The old anonymous link redirects to the claimed artifact. Claiming makes it private; use access to restore the intended audience. Keep the claim URL private: it is for claiming ownership and cannot authorize anonymous updates.

Publish now

npx @sendartifact/cli publish report.html --anonymous --json
# Or publish a complete build folder, including CSS, JavaScript and images:
npx @sendartifact/cli publish ./dist --anonymous --json

The unlisted page stays live for seven days. Give readers url; give the creator claimUrl separately and privately so they can claim it to keep it. Never put the claim link in the artifact. A failed account sign-in does not fall back to anonymous publishing.

The CLI requires Node 18.3 or later. Use --help, --version, or publish --help without credentials. A connected account uses the commands below. Hosted chat assistants use the MCP connector instead: https://sendartifact.com/connect.

Connect an account

npx @sendartifact/cli login [email protected]
npx @sendartifact/cli login [email protected] --code 123456 --handle your-handle
npx @sendartifact/cli whoami --json
npx @sendartifact/cli publish ./dist --slug report --json

The emailed code signs in or creates the account. The CLI saves the key in ~/.config/sendartifact/credentials.json, separately per origin. It does not print the key; use login ... --show-key only when you need to reveal it. ARTIFACT_API_KEY overrides saved credentials. ARTIFACT_ORIGIN selects a different API origin; ARTIFACT_CREDENTIALS_FILE selects another credential file.

Account creation defaults private. Specify another audience only when the user requests it. Use keys, keys revoke <id>, or logout to manage this machine's connection; keys revoke --all --yes explicitly revokes all keys.

Address an artifact

All artifact commands, including the publish --slug option, accept these forms:

artifact inspect report --handle your-handle --json
artifact inspect your-handle/report --json
artifact inspect https://sendartifact.com/your-handle/report --json

Use ARTIFACT_HANDLE for a selected handle. Without an explicit selection, the CLI uses the sole account handle; it asks you to select when there is more than one. It never guesses from list order. URLs must belong to the configured origin, and their handle must match any explicit --handle. Claim temporary /a/ artifacts before managing them with account commands:

artifact claim '<private-claim-url-or-token>' --json
artifact list --query report --json

Read and revise a complete bundle

artifact read your-handle/report --out-dir ./report-edit --json
# Edit files in that new directory. Keep the returned revision.
artifact publish ./report-edit --slug your-handle/report --base-revision <revision> --json

read --out-dir exports every current file, including binary assets, to a new directory. inspect --json returns metadata, file inventory and revision without the file bytes. read --json returns a single file with its revision, encoding and content; read --path style.css chooses another file. A single-file read is not a complete bundle export. --out <file> writes one file locally.

Republishing replaces the full file set. Since 0.6.0 the server rejects a revision that would drop files it was not given (this also applies to dashboard and API uploads); add --allow-remove-files (API: protect_files=false) when removal is intentional. --base-revision rejects intervening edits, including deletion and recreation at the same slug. Use the revision from the live read for agent edits. Existing scripts may omit this optional guard, but then stale edits are not detected. New publications default private; omitted sharing settings on revisions stay unchanged.

Publish HTML from stdin using publish - --slug report or publish - --anonymous. Text, binary and relative asset paths must all be present in the publication. The decoded bundle limit is 25 MiB. Build apps for relative paths (for Vite, base: './'). The CLI does not run your source build or provide an application server.

Sharing and feedback

artifact access your-handle/report --visibility link --require-email capture --json
artifact access your-handle/report --visibility guests --grant [email protected] --grant=acme.com --json
artifact access your-handle/report --comments off --json
artifact comments your-handle/report --json
artifact reply your-handle/report <comment-id> --body-file ./reply.txt --json
artifact resolve your-handle/report <comment-id> --json

Access changes affect only supplied settings. Omitted grants remain unchanged; repeated --grant flags replace the whole list, and --clear-grants clears it explicitly. Email modes are none, capture, and verified. Apply an audience and its requested email gate together.

When the user asks to address feedback, fetch comments --json for complete bodies, anchors and replies; the human display is a short summary. Read/export the live bundle, make and publish the requested fixes with its revision, reply with what changed, then resolve addressed threads. Replies never change thread status; resolving never adds a message. A question or declined suggestion needs only a reply. reply --body-file - reads stdin; --body "text" remains available. Legacy resolve --reply and --reply-only forms work for older scripts but are not the preferred interface.

analytics and rollback --version <n> remain existing CLI capabilities. They are excluded from the initial hosted MCP scope. delete <artifact> --yes requires the actual boolean flag: --yes=false is rejected.

Automation output and retries

Every action supports --json: one success JSON value on stdout, or {error:{code,message,status,retryable,details?}} on stderr with exit code 1. Warnings may appear as a separate JSON diagnostic on stderr without changing the success shape. read --json encodes binary content as base64. Keep returned canonical handle, slug, url, and revision for subsequent calls.

Publication is not currently deduplicated by an idempotency key. If a response is lost, the write may have succeeded: do not blindly retry. Inspect an account artifact to reconcile it; a lost anonymous response cannot recover its private claim link. Revision guards prevent stale overwrites but do not replay the original publication result.

Use artifact <command> --help for options supported by your installed version. The agent manual and installable skill cover account publishing, privacy and the author-directed feedback loop.