objects-storage

objects-storage is a narrow file-sharing skill. It handles a temporary benchmark result, report, or image no larger than 10 MB through the public Objects API. Each upload enters a Cloudflare Queue screening gate before a public object is promoted, then the normal seven-day lifecycle removes it.

The raw skill material

The hosted skill is directly readable by an agent client. Use the raw Markdown for the workflow and the adjacent OpenAI interface document for discovery metadata.

Install it for every agent supported by the Skills CLI in the current project:

1npx skills add bas3line/rool-repo --skill objects-storage --agent '*' --yes

Eve and PromptScript intentionally support project skills only. For a global Codex installation, target Codex explicitly:

1npx skills add bas3line/rool-repo --skill objects-storage --agent codex --global --yes

The skill requires raw bytes rather than multipart form data and never lets a caller pick a storage path. The API creates an unguessable object identifier, keeps it under a private pending prefix, and returns a future public URL plus a status endpoint.

Upload and retain only what is needed

Set an accepted content type and enforce the 10 MB limit before upload. Plain text, Markdown, CSV, JSON, NDJSON, PNG, JPEG, WebP, and AVIF are accepted. The service rejects executables, archives, compressed blobs, packages, HTML, SVG, and model files. The returned deletion token is private capability material, not an identifier or a URL parameter.

123curl --fail-with-body --data-binary @benchmark.json \
  -H 'content-type: application/json' \
  https://objects.yshubham.com/v1/objects

The initial response is 202 with statusUrl. Poll it until status is ready, then download through the returned URL. A quarantined upload was never public. Treat a later 404 as normal expiry rather than an invitation to fan out retries or find an origin bucket URL.

Delete early when needed

Use the returned delete token only through an authorization header or the supported x-object-token header. If it is lost, wait for expiry instead of trying to enumerate or recover the object.

123curl --fail -X DELETE \
  -H "authorization: Bearer $OBJECT_DELETE_TOKEN" \
  https://objects.yshubham.com/v1/objects/OBJECT_ID

The Worker fails closed when its upload-protection or Queue binding is unavailable and does not log capability tokens on internal errors. The consumer rechecks bytes before promotion, retries transient failures, and sends exhausted messages to a dead-letter queue. Respect 429 with backoff and never bypass it using a guessed origin endpoint.