Teach the port-map-to-share workflow (never share /proxy/ links) in the adom-cli skill

Overview Files Skills Discover Packages Releases Dependencies Issues Breadcrumbs Pull Requests Activity

Closed feature request

Ray · 2mo ago ·closed by Colby Knox

Re-homed here from adom/adom-security #513 per Colby's steer: that page looks deprecated, and adom-cli is where port mappings live and where this guidance would actually get invoked.

Context

Colby (2026-08-07): "mine does it automatically, but I always say 'give me a link so I can share' and it'll do the port map without me telling it directly." His AI already reaches for carbon containers port-add when asked for a shareable link.

The default adom-cli skill does not teach that. So a novice-facing AI session (mine, this week) just copied the Hydrogen webview …adom.cloud/proxy/<port>/… URL and shared it with the team. Colby flagged the exposure: "it takes one time to accidentally send it out for your container to be compromised."

Right next to carbon containers port-add, add a short section:

Making a shareable link for a locally-served page

To share a page or app served locally in the container (demo, mockup, dev server), do NOT share the Hydrogen webview …adom.cloud/proxy/<port>/… URL. It carries the container slug and points at an unauth'd local port; one accidental send exposes every dev service on the container. Create a port mapping and share the clean hostname instead:
adom-cli carbon containers port-add <slug> --port <PORT> --prefix <name>   # slug: adom-cli carbon containers current
# -> https://<name>-<random>.adom.cloud/  routes to :<PORT>
/proxy/<port>/ is fine only for your own in-container webview preview.

Plus add trigger words so the skill loads at the right moment (someone asking to share): share a link, shareable link, share a demo, demo link, preview link, expose a port, port mapping, /proxy url.

This is the "make it automatic for everyone" version of what Colby's AI already does by habit.

1 Reply

Colby Knox · 2mo ago

Shipped as adom/adom-cli 4.1.1 (skills-only release, same binary). Both halves of the ask landed:

The containers skill now leads the sharing section with the danger framing rather than the old "cannot be shared" shrug: NEVER share the Hydrogen webview proxy URL, it carries the container slug and addresses an unauthenticated local port, one accidental send exposes every dev service on the container; a request to share anything locally served is a request for a port mapping, full stop. The port-add flow, prefix guidance, and revocation note follow, with /proxy reserved explicitly for the user's own in-container preview.
Trigger words are on both layers so the guidance loads at share intent: the hub skill description and the containers subskill now carry share a link, shareable link, share a demo, demo link, preview link, give me a link, expose a port, proxy url.

Verified in the published 4.1.1 tarball; the fleet picks it up through the normal update chain. Source repo commit is on adom-inc/adom-cli main. One process note: the skills-only publish initially tripped HERO_DECLARATION_DANGLING because the republish workspace missed screenshots/; the hero asset is restored and the page renders fine. Closing.

adom-cli