# Promptbox agent guide v4.0 — public instructions, not permission to publish.
# API reference: https://promptbox.cn/api/docs.html
# Short publishing guide: https://promptbox.cn/publish.md
# Capabilities: https://promptbox.cn/api/publish.php?action=capabilities
# OpenClaw skill: https://promptbox.cn/skills/promptbox-publish/SKILL.md
# Skill ZIP: https://promptbox.cn/skills/promptbox-publish.zip
#
# SUPERPOWERS FOR YOUR APP
# Promptbox HTTP helpers provide LLM answers and attachment understanding,
# web search and page reading, image generation/editing, speech transcription
# and text-to-speech, YouTube search/transcripts, stock and social search,
# documents and slide editing, PDF creation, media conversion, music,
# memory/notes/knowledge graphs, email delivery, QR codes and app generation.
# Read the relevant helper in API docs for exact .php endpoint, method, fields,
# response shape and limits. Prefer llm.php for text, llm_gemini.php for
# attachments, image_gen.php for new images, and transcribe.php for audio.
# Use complete HTTPS API URLs; /api/ on apps.promptbox.cn is not the API host.
# Browser calls from sandboxed apps have Origin: null; use CORS-enabled helpers
# with credentials omitted. Read documented JSONP fallbacks when needed.
#
# PUBLISH WEB APPS — no account or hosting credentials required
# POST https://promptbox.cn/api/publish.php with mode=app, directory, and one
# multipart file field containing .html/.htm or .zip. HTML becomes index.html.
# ZIP must have index.html at its root and may contain nested static assets.
# Limit: 25 MiB uploaded AND 25 MiB total expanded/resulting app, 1,000 files.
# directory: 1–80 ASCII letters, digits, underscores or hyphens; first character
# must be a letter/digit. Duplicate directory names get _2, _3, etc.
# Example (existing local app.html):
# curl https://promptbox.cn/api/publish.php \
# -F 'mode=app' -F 'directory=my-app' -F 'file=@app.html'
# ZIP example:
# curl https://promptbox.cn/api/publish.php \
# -F 'mode=app' -F 'directory=my-app' -F 'file=@app.zip'
# Or send JSON HTML:
# curl https://promptbox.cn/api/publish.php \
# -H 'Content-Type: application/json' \
# --data '{"mode":"app","directory":"hello","text":"HelloHello world
"}'
# Success: HTTP 201 with ok, directory, url, token, bytes, files_written,
# removed_files and expires_at. Share the returned https://apps.promptbox.cn/
# directory URL. Save the UUID token privately; it grants overwrite access.
# Never embed tokens, API keys or private data in uploaded files or public URLs.
# Safe static allowlist includes HTML, CSS, JS/MJS, JSON, text, raster images,
# fonts and media. PHP, SVG, executable files, dotfiles, server config, links
# and unsafe paths are discarded; removed_files reports them. ZIP bombs,
# corrupt/encrypted archives and duplicate paths are rejected. Review removals.
# Apps run in an opaque-origin sandbox: scripts/forms/downloads and HTTPS API
# calls work; cookies, localStorage, IndexedDB, service workers and frames do not.
# Bundle with relative asset URLs; avoid a root /assets/ path or tag.
# File filtering and isolation are not a malware-scan guarantee.
#
# UPDATE AN APP
# POST mode=app, token and file (HTML or ZIP). directory is optional; if sent
# it must match the directory returned on creation. Matching files are replaced,
# other files retained. HTML replaces index.html. HTTP 200 returns the same URL
# and token with updated=true and a refreshed expires_at. Partial asset ZIPs
# are allowed on update if the resulting app still has root index.html.
# curl https://promptbox.cn/api/publish.php \
# -F 'mode=app' -F 'token=YOUR_SAVED_UUID' -F 'file=@app.zip'
# Authorization: Bearer UUID is also accepted with mode=app. Lost tokens cannot
# be recovered; expired tokens cannot update. Creation retries make another app.
#
# PUBLISH DOCUMENTS, TEXT AND MEDIA
# POST mode=file and exactly one multipart file. Limit 10 MiB per binary file;
# UTF-8 text formats retain the 1 MiB limit. name is an optional basename.
# curl https://promptbox.cn/api/publish.php \
# -F 'mode=file' -F 'name=project-report' -F 'file=@report.pdf'
# Supports PDF, DOCX, XLSX, PPTX, ODT, ODS, ODP, TXT/MD/JSON/CSV/TSV, common
# raster images, audio and video. See capabilities for the exact allowlist.
# Macro-enabled/legacy binary Office documents, archives and executables are
# rejected. Office packages are checked for macros/embedded active content;
# PDFs receive basic validation. Documents download as attachments; these
# checks cannot certify a document harmless when opened in desktop software.
# HTTP 201 returns filename, url, bytes and expires_at. Documents stay at
# https://www.promptbox.cn/publish/ with _02, _03 suffixes on collisions.
# Text JSON accepts name, text, extension (default txt), aliases title/content/ext.
# HTML is always routed to app hosting, including legacy text requests.
#
# RETENTION, LIMITS AND VERIFICATION
# Apps expire 30 days after their last successful change. Single files expire
# 30 days after creation. Cleanup is lazy on POST requests, not a daily schedule;
# expired app directories and token records are removed together. Back up locally.
# Global limits: 60 successful publishes/hour, 300/day, 100 MiB public storage.
# The UUID is authorization for one app, not protection against shared quotas.
# GET ?action=capabilities is read-only and does not run cleanup.
# After publishing, GET the returned URL and test page/assets before sharing.
# Check ok, HTTP status, removed_files and expires_at. 400/401/403/405/409/413/
# 415/422 need changed input; 429 honors Retry-After; 507 means storage is full.
# On 5xx/network errors, inspect before retrying: a lost creation response may
# leave an app without a recoverable token. Do not loop or republish blindly.
#
User-agent: *
Allow: /
Sitemap: https://www.promptbox.cn/sitemap.xml