feat: allow artifact management and transfer workflows

opencode-server/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: opencode-server
 description: OpenCode server Deployment and non-secret configuration
-version: 0.1.58
+version: 0.1.59
 appVersion: "1.18.23"
 type: application

opencode-server/files/opencode.json

@@ -9,6 +9,12 @@
   "enabled_providers": ["kimi-for-coding", "minimax-coding-plan", "openai", "zai-coding-plan"],
   "provider": {"kimi-for-coding": {"options": {"apiKey": "{env:KIMI_API_KEY}"}}},
   "permission": {
+    "external_directory": {"/artifacts/*": "allow"},
+    "glob": {"/artifacts/*": "allow"},
+    "grep": {"/artifacts/*": "allow"},
+    "list": {"/artifacts/*": "allow"},
+    "read": {"/artifacts/*": "allow"},
+    "edit": {"/artifacts/*": "allow"},
     "agent-pipe_download_artifact": "ask",
     "agent-pipe_inspect_artifact": "allow",
     "agent-pipe_upload_artifact": "ask",

opencode-server/files/skills/cloud-artifact-transfer/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: cloud-artifact-transfer
+description: Use when moving a non-sensitive artifact between `/artifacts` and approved cloud storage through a signed URL.
+---
+
+# Cloud artifact transfer
+
+Use the `agent-pipe` MCP service only to move bytes through a configured,
+capability-scoped transfer profile. It is not a cloud administration service.
+
+## Boundaries
+
+- Cloud MCPs own resource discovery, bucket configuration, IAM, object metadata,
+  and signed URL generation. Do not use `agent-pipe` to replace them.
+- `agent-pipe` owns data-plane transfer for files under `/artifacts`; it has no
+  cloud credentials and cannot list, delete, or administer buckets.
+- The currently configured profile is `agent-pipe`, for the private S3 bucket's
+  `deliveries/` prefix. Do not invent a profile or use an arbitrary URL.
+- Never transfer OpenTofu state, credentials, decrypted SOPS values, kubeconfigs,
+  private keys, raw logs, or other sensitive content.
+- Signed URLs are bearer capabilities. Do not print, quote, persist, or include
+  them in user-facing output.
+
+## Inspect
+
+Use `agent-pipe_inspect_artifact` before a transfer when file size or identity
+needs verification. It returns non-sensitive metadata for an existing file under
+`/artifacts`.
+
+## Upload and verify
+
+1. Confirm the artifact is user-directed and non-sensitive.
+2. Use the appropriate cloud MCP to verify the target account, region, bucket,
+   and object-key policy, then mint a short-lived PUT URL for the approved profile.
+3. Ask for explicit confirmation showing the artifact path and object key, but
+   never the signed URL.
+4. After approval, call `agent-pipe_upload_artifact` with the profile, relative
+   artifact path, and unchanged signed URL. Its permission prompt must be approved
+   for that exact transfer only.
+5. Verify the uploaded object through the cloud MCP. Then mint a short-lived GET
+   URL and call `agent-pipe_verify_download` with the same profile before sharing
+   it with the user.
+
+## Download
+
+1. Confirm the destination is a new, non-sensitive relative path under
+   `/artifacts` and will not overwrite another artifact.
+2. Use the cloud MCP to mint a short-lived GET URL for an approved profile.
+3. Ask for explicit confirmation before calling `agent-pipe_download_artifact`.
+4. Inspect the resulting artifact before using or sharing it.
+
+The `agent-pipe_upload_artifact` and `agent-pipe_download_artifact` tools are
+approval-gated. Do not use an always-allow decision for transfers.

opencode-server/files/skills/s3-presigned-file-delivery/SKILL.md

@@ -7,6 +7,9 @@ description: Use when the user asks to download, share, or get a link to an S3 o
 
 Deliver a file from AWS S3 to the user as a clickable, time-limited download link using the `aws` MCP integration. Use when the user asks to download, share, or "get a link to" an S3 object, or to hand a session artifact to storage.
 
+Apply the `cloud-artifact-transfer` skill's transfer boundaries and approval
+rules. This skill adds the `agent-pipe` S3 profile and delivery-specific policy.
+
 ## Default delivery bucket
 
 Use the private `agent-pipe` bucket by default after its OpenTofu root has been applied and functional access has been verified. It is for short-lived, non-secret agent-to-user artifacts only — PDFs, reports, and other user-requested outputs — under the `deliveries/` prefix.