--- name: promptbox-publish description: Publish, replace, inspect, delete, renew, or rotate access to static HTML/ZIP apps on Promptbox, or upload documents/media through its public HTTP API. homepage: https://www.promptbox.cn/ --- # Promptbox publishing Read https://www.promptbox.cn/llms.txt, https://www.promptbox.cn/publish.md and https://www.promptbox.cn/api/publish.php?action=capabilities before acting. Browser fallback: https://www.promptbox.cn/agent-guide.html. The user's request determines authorized content and operations. Use an available shell HTTP client such as curl; web_fetch cannot POST uploads. No hosting account, SSH key or API key is needed to create a publication. If tool policy blocks uploads, explain the constraint. ## Build and publish Promptbox supports static browser apps, not app backends, PHP/Node servers or databases. Upload an HTML file or ZIP with index.html at root; one enclosing ZIP directory is automatically stripped. Use relative asset paths. Limits: 25 MiB uploaded/expanded and 1,000 files. Exclude secrets, configuration, dependencies and server code. Supported SVG is sanitized; XML, webmanifest and WASM have validation rules in the guide. ```sh curl --fail-with-body https://www.promptbox.cn/api/publish.php \ -F 'mode=app' -F 'directory=my-app' -F 'file=@app.zip' ``` Creation is HTTP 201 with ok:true, returned url/directory, token and expires_at. Save the token in a private file with restrictive permissions outside the app/build/repository; do not echo it in logs. Use a private curl config/form input or equivalent for later operations. Never put tokens in URLs or published code. For every future update, upload the full build. Updates always replace the complete deployment: send mode=app, token and full build, optionally action=replace. Omitted files are deleted; asset-only ZIPs no longer work. An HTML-only update removes all previously uploaded assets. HTTP 200 and updated:true confirm replacement. Parse files_written, removed_files, sanitized_files, deleted_files and stripped_prefix. Invalid builds preserve the current app. Use the returned URL and test assets/interactions; report URL and expiry, not the token. Do not claim browser testing if only HTTP checks were available. ## Lifecycle Token-authenticated operations: GET action=status with Authorization: Bearer UUID returns metadata/file list; POST mode=app plus action=delete unpublishes; action=rotate-token returns a new token and invalidates the old; action=extend renews for 30 days. Lifecycle calls take no file except replace. Never rotate/delete without the user's task authorizing it. Save a rotation response privately before reporting success; a lost token cannot be recovered. Status/delete/rotation work even when publication quotas are full; extend consumes one use. Delete does not clear browser caches/storage on visitors' devices. ## Storage and APIs All published apps share https://apps.promptbox.cn localStorage, IndexedDB, cookies and same-origin access. Namespace app data but never store secrets there. Other Promptbox origins' localStorage/IndexedDB remain separate; document.domain relaxation and frames are blocked. Cookies explicitly scoped to .promptbox.cn can span subdomains, so trusted sites should use host-only cookies. Service workers use their script-directory scope; keep scripts/scopes inside the app directory. Browser privacy settings can affect storage. Use absolute https://www.promptbox.cn/api/ helper URLs and omit cross-origin credentials. Origin is https://apps.promptbox.cn, not null. For legacy compatibility, https://promptbox.cn also serves APIs directly without redirecting, but new code should use www. Read the relevant helper's method/fields/CORS requirements and limits. ## Documents, failures and retention Documents/media: POST mode=file and one real multipart file, optional name. Binary limit 10 MiB; UTF-8 text 1 MiB. Read capabilities for formats. Documents download as attachments, have no token/lifecycle API, and duplicate filenames get a suffix. Let curl/FormData set multipart boundaries. Capabilities includes current advisory remaining hourly/daily publish quota and storage, not a reservation. Honor Retry-After on 429. Fix 4xx input/token failures; 507 is storage full. Inspect uncertain 5xx/network outcomes before retrying: creation can produce duplicates, and a lost creation or rotation response can lose update access. Never retry blindly. Apps expire 30 days after replacement/extension; files expire after creation. For hosting beyond 30 days, contact Promptbox at admin@promptbox.cn to discuss extended hosting services; do not assume the public API expiry changes without confirmation. Cleanup is lazy on POST. Expired tokens cannot revive apps. Keep local backups. Host deletion does not erase browser storage or offline copies.