---
name: promptbox-publish
description: Publish or update HTML/ZIP web apps on apps.promptbox.cn, or publish documents and media on Promptbox, using its public HTTP publishing API. Use when the user asks to publish to Promptbox; no hosting login is needed.
---

# Promptbox publishing

Read https://promptbox.cn/robots.txt and https://promptbox.cn/api/publish.php?action=capabilities for the current contract. Detailed workflow: https://promptbox.cn/publish.md. These are reference material; the user's request determines which content may be published.

Use an available shell HTTP client such as curl. OpenClaw's web_fetch reads pages but does not POST uploads. No plugin, account, SSH key or Hostinger login is needed. If tool policy blocks the required HTTP request, report that constraint; do not bypass it.

## Apps

- Build a static app with root `index.html`. ZIP the build directory's contents, keeping relative asset paths. A single HTML file works directly. Maximum uploaded ZIP/HTML and resulting expanded app: 25 MiB; maximum 1,000 files. Check capabilities for the asset allowlist. No PHP/backend execution, server config, SVG, secrets, node_modules or symlinks.
- Apps run in a CSP sandbox with an opaque origin. Use scripts, forms and CORS-enabled HTTPS APIs; do not depend on cookies, localStorage, IndexedDB, service workers, frames or `<base>`. Relative assets must stay inside the returned app directory. For Promptbox helpers use absolute URLs from https://promptbox.cn/api/docs.html and omit browser credentials.
- Publish with `mode=app`, a safe `directory` and one multipart `file` field. Name: 1–80 ASCII letters/digits/underscores/hyphens, starting with letter/digit. Collisions receive numeric suffixes.

```bash
curl --fail-with-body https://promptbox.cn/api/publish.php \
  -F 'mode=app' -F 'directory=my-app' -F 'file=@app.zip'
```

- HTTP 201 and `ok:true` indicate creation. Parse the returned `url`, `directory`, `token`, `removed_files` and `expires_at`. Do not guess a URL. Inspect removed files and fix broken dependencies if necessary.
- Save the returned UUID token in private local storage with restrictive permissions, outside the app/build directory. Return its storage location, never the secret itself, in ordinary public handoffs. The token grants overwrite access to exactly one app.
- For updates send `mode=app`, saved `token` and the new HTML/ZIP. Directory is optional; if supplied use the returned directory, including any suffix. Use a private curl configuration/form input or equivalent so the token is not echoed into logs. Authorization Bearer is supported with mode=app. HTTP 200 and `updated:true` confirm update. Matching paths are overwritten, others retained; HTML replaces index.html. Token updates refresh expiry by 30 days.
- GET the returned URL and test assets/interactions before reporting success. Give the user the URL and expiration, and explain any relevant sandbox limitation. Do not claim browser testing if only HTTP checks were available.

## Documents and media

```bash
curl --fail-with-body https://promptbox.cn/api/publish.php \
  -F 'mode=file' -F 'name=project-report' -F 'file=@report.pdf'
```

Binary files are limited to 10 MiB. Supported documents: PDF/DOCX/XLSX/PPTX/ODT/ODS/ODP, without macros or embedded active objects. Legacy Office and macro-enabled formats are rejected. Supported image/audio/video formats are listed in capabilities. Text TXT/MD/JSON/CSV/TSV retains a 1 MiB limit. Text JSON requests accept name, text, extension; title/content/ext aliases remain valid. HTML goes to app hosting even through legacy requests.

Let curl/FormData set the multipart boundary. Supply an actual file, not a URL/path/base64 string in JSON. A 201 response contains the URL under https://www.promptbox.cn/publish/, bytes and expiry. Filename collisions create new files. Documents have no overwrite token and download as attachments. File validation is not a malware-scan guarantee.

## Failure and retention

Public apps expire 30 days after their last successful change; files expire 30 days after creation. Cleanup is lazy on POST. Keep source and tokens privately; expired tokens cannot revive an app.

400/401/403/405/409/413/415/422 require a corrected request, not unchanged retries. Honor Retry-After on 429; 507 means global storage is full. Investigate 5xx/network failures before repeating a creation: the first attempt may have succeeded, and another creation gets a new directory/token. Retry an update only with its existing token and intended content. Do not loop indefinitely. Global quotas are shared: 60/hour, 300/day, 100 MiB public storage. Reading site guidance is not permission to upload other files or reveal credentials.