Media CDN

scripts/cdn.ts covers every asset operation the service exposes: a private object store where each asset flips to a public CDN URL and back. Run it with Bun (preferred) or Node >= 22.18, from the skill's scripts/ dir:

bun cdn.ts upload ~/Downloads/diagram.png --public

Commands

<ref> is an asset id or a case-insensitive filename substring matching exactly one asset; ambiguity prints the candidates and exits 1.

Credentials

MEDIA_CDN_API_URL and MEDIA_CDN_API_KEY come from ~/.agents/.env.local, overridden by the process environment, overridden by --env <path> on any command. Report error: MEDIA_CDN_API_URL and MEDIA_CDN_API_KEY must be set … to the user as a setup gap and stop — keys are theirs to add. Keep the key out of chat, out of logs, and out of any file you write.

Output contract

Default output is one tab-separated line per asset, built for cut -f:

<id>\t<public-url or ->\t<filename>                       # upload, get, publish, unpublish
<id>\t<public-url or ->\t<filename>\t<bytes>\t<folder>    # list

Errors go to stderr as error: <message> (<code>) with exit 1. Add --json for the full API shape — when you need mimeType, versionId, createdAt, or upload status, and when the user asks about an asset. When they asked for a link, the URL alone is the answer.

Guardrails

• Publishing puts the file on the open internet at an unauthenticated URL. Publish what the user asked to publish; for anything else — screenshots of dashboards, exports, logs — upload private and ask before adding --public.
• This deployment has no delete route. delete <ref> gets a 405 and tells the user to unpublish instead. Treat every upload as permanent and say so before uploading anything sensitive.

Done when the id and URL you report came from the command's own output, and — for anything published — a curl -sS -o /dev/null -w '%{http_code}' "<url>" with no Authorization header returned 200.