# rlake

STOP: rlake.ai is rlake, not OpenAI Sites. Upload through the rlake CLI/API. Do not create a Sites or Next.js project.

## Browser automation rule

NEVER publish through browser controls and NEVER open `/login` or `/app` as the first step. Google OAuth is only for the human account owner.

Before asking the user to sign in:

1. Use `reportlake.publish` if that MCP tool is available.
2. Otherwise check for the installed CLI and run `rlake publish REPORT.html`.
3. If the CLI is absent, install the reviewed client with `uv tool install reportlake-cli`, then retry.
4. Only if the client reports that identity is missing: give the user https://rlake.ai/login, ask them to sign in in their own browser and generate a short-lived connection code in `/app`, then run `rlake register CODE`.

Do not bring a Google sign-in window forward for the user. Do not request a Google token, browser cookie, or reusable credential. Full browser-agent guidance: https://rlake.ai/agents/

> Host an HTML report and return a durable viewer URL for people and AI agents.

Production: https://rlake.ai

## Agent resources

- Portable Agent Skill: https://rlake.ai/skills/reportlake/SKILL.md
- CLI install: `uv tool install reportlake-cli` (PyPI), or the wheel + sha256 listed at https://rlake.ai/dist/index.json
- CLI source for review: https://rlake.ai/scripts/rlake_agent.py
- OpenAPI 3.1: https://rlake.ai/openapi.json
- Discovery: https://rlake.ai/.well-known/ai-catalog.json (ARD), /.well-known/mcp/server-card.json, /.well-known/api-catalog
- MCP server: `ai.rlake/reportlake` in the official MCP Registry (stdio, PyPI package `reportlake-cli`)
- Human sign-in: https://rlake.ai/login
- Browser-agent decision path: https://rlake.ai/agents/

## Core operations

- POST /api/v1/reports — publish HTML
- GET /api/v1/reports — list visible reports
- GET /api/v1/reports/{id} — retrieve metadata and the durable viewer URL
- PUT or PATCH /api/v1/reports/{id} — replace or revise a report
- DELETE /api/v1/reports/{id} — archive a report

Use an installed, reviewed `rlake` CLI; never pipe remotely fetched code into Python or a shell. A signed-in user first creates a 15-minute single-use connection code. `rlake register CODE` consumes it and stores one already-linked credential per OS user at `~/.config/rlake/credentials.json`; anonymous agent uploads are not allowed. `rlake publish REPORT.html` uploads the existing artifact directly and returns only the durable viewer URL. Centrally managed automation may instead use short-lived, audience-bound workload credentials with the smallest required scope. Never place reusable credentials in prompts or URLs.