Files

T

nntrivi2001 22de5009ff feat: v2.7.8 — Artifacts hub, clone related repos as extra folders, quieter resume prompt

- Artifacts (/artifacts): claude.ai pages sessions publish (captured from the
  Artifact tool's hook), pinned workspace files, skills and plugins, each
  kept as a snapshot; shared ones appear in a Hub and a skill or plugin
  installs into the viewer's own account (server/lib/artifacts.js,
  /api/artifacts, docs/plans/artifacts/).
- Workspace extra folders: clone one or more related repos beside the
  workspace and add them in one step (POST /api/lanes/:id/sources/clone).
- A pane that ended by itself while tmux kept running is no longer offered
  for resume (tmux.serverStartedAt in reconcileOrphans).
- Changes panel: a folder that is not a git repo opens on Files, and its
  files open from there.
- Plus the parallel sessions' work in this tree: File Explorer button in the
  panel header, user delete, RSA SSH keys, chat/terminal and pet fixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-14 16:06:54 +07:00

4.3 KiB

Raw Blame History

Artifacts hub — plan

Drafted 2026-10-14. Status: all three phases built 2026-10-14 (the session view's own Artifacts tab is not built; the page has the per-workspace file picker).

Goal

One place to keep what agents PRODUCE, and (in server mode) to share it:

Kind	What it is	Where it comes from
`page`	A claude.ai Artifact a session published (`claude.ai/…/artifact/…`)	the `Artifact` tool's PostToolUse hook, or a link pasted by hand
`file`	A file an agent wrote (HTML, Markdown, PDF, image, CSV, Office…)	Write/Edit/NotebookEdit hook events, kept on the user's pin
`skill`	A Claude Code skill folder (`SKILL.md` + files)	the user's own `~/.claude/skills/<name>` or a workspace's `.claude/skills/<name>`
`plugin`	A plugin by marketplace source + name (no files)	the user's installed plugins (`claude plugin list`)

Local mode: one personal library, no sharing UI.
Server mode: every artifact is the OWNER's and private by default. The owner can Share it; a shared artifact appears in the Hub for every signed-in user. A shared skill or plugin can be installed into the viewer's own account.

Rules (binding, same spirit as CLAUDE.md)

What is shared is a SNAPSHOT, never the owner's live file. Sharing a file/skill copies it (size-capped, regular files only, no symlinks followed) into <data dir>/artifacts/<id>/, written once like session_snapshots. Viewers read only that copy, so no route ever reads another user's home for them. Re-sharing makes a new snapshot.
Nothing shared runs on the dashboard's origin. HTML/SVG previews are served under the /git/raw headers (sandbox CSP + nosniff) and shown in a sandboxed iframe; a page is only a link out, accepted only as https://claude.ai/….
Installing is the viewer's explicit click, into the viewer's own account only. For a skill, the hub writes the snapshot's files into ~/.claude/skills/<name>/ of the VIEWER (S3: as their member, through write-as). It never overwrites an existing skill without conflict: replace, and the old one goes to the trash first. For a plugin, the hub runs claude plugin marketplace add <source> + claude plugin install <name>@<market> --scope user as the viewer (the applyPluginBaseline path). The marketplace source passes an allowlist (owner/repo or a validateRemoteUrl URL), and no argv comes from the request beyond those two validated values.
Before installing, the dialog lists every file of the skill (a skill may carry scripts that the viewer's agent will run). Every share, unshare and install is written to audit_log.
Visibility follows ownership: a developer sees their own artifacts plus shared ones; admin/analyst see per scope.js, like sessions. Unshare removes an artifact from the Hub but does not uninstall copies others already installed.

Data

New table artifacts (CREATE TABLE IF NOT EXISTS in server/db.js):

id, kind, title, description, owner_id, lane_id, session_id, source (path | url | market spec), url, snapshot (dir name | NULL), size, shared (0/1), shared_at, installs, created_at, updated_at, plus an index on (owner_id, kind) and on (shared, kind).

Phases

Library (local + server, private). Table, server/lib/artifacts.js, /api/artifacts (list/get/create/patch/delete). page rows are captured from the Artifact PostToolUse hook (URL taken from tool_response by an https://claude.ai/…artifact/… match). file candidates are listed per workspace from Write events with a document extension, and the user pins them. New Artifacts page (sidebar) plus an Artifacts tab in the session view's right panel. Scope wiring: PATH_RULES, broadcastAudience.
Hub (server mode). Share/Unshare buttons, snapshot, Hub tab, sandboxed preview, download, artifact_shared broadcast.
Skills & plugins. "Share a skill/plugin" picker, the install flow (S3 included), conflict handling, audit.

Each phase ships with its server and client tests and an update to docs/API.md.

Open questions

No Artifact tool call has happened on this machine yet, so the exact hook payload of a publish is unverified. Phase 1 matches the URL loosely and keeps "paste a link" as the fallback.
Should an admin be able to disable Hub installs for everyone (one switch in Settings)? Proposed: yes, on by default.

4.3 KiB Raw Blame History