Prepare for tinycloud 0.3.14: opt-in Open Graph link previews (skill floor → 0.3.14)

[kdr]

Summary

0.3.14 adds opt-in Open Graph link previews, so a pasted Cloudglue link unfurls as a real card in Slack, iMessage, Notion, and friends instead of a bare URL or a generic "Sign in" card.

Binary contract (built from the private source repo) — new feature id publish.link.preview.v1, features 33 → 34, verbs stay 16:

• publish and publish video gain --link-preview none|full
• site publish also gains --preview-title / --preview-image

What the skill now teaches

The two visibilities work completely differently, and that distinction is the substance of the doc change:

• Public sites need no flags. Their HTML reaches the unfurl bot verbatim, so the card is whatever og:* tags the generated page carries. The skill now tells generators to emit og:title/og:description/og:image (absolute url)/og:url/twitter:card on every public publish — a regenerated page without them silently reverts the card to a bare link. Bots don't run JS, so the tags must be in the static HTML; never twitter:player/og:video.
• Private sites and shares are redirected to sign-in before a bot sees anything, so they need --link-preview full to opt into a metadata-only stub. On a site that also takes --preview-title and --preview-image (must be publicly fetchable — site assets sit behind the same gate the bot can't pass). Flipping it on an existing site is a settings PATCH with no re-upload, reported as the new settings-only action.

Every mention carries the privacy caveat, and the skill says to ask the user first: opting in makes the card title, description, and image readable by anyone who fetches the link. Site content, video, tokens, and cookies never leak, and playback stays sign-in gated. Platforms cache per exact URL and rehost images, so turning it back off does not retract already-posted cards.

Touched: skills/tinycloud/reference/verbs.md (both publish sections), glossary.md (new "Link preview" entry), skills/tinycloud/SKILL.md, and the release-state paragraph in CLAUDE.md.

⚠️ Skill floor → 0.3.14 (merge ordering)

Because the skill teaches the new flags, min_version, supported_range, preflight MIN_VERSION, and publish.link.preview.v1 in both required-feature lists all move to 0.3.14. Following the 0.3.12 floor-raise pattern, this PR should merge only after the CDN's channels.stable is 0.3.14 — otherwise preflight fails for anyone on the current stable build.

Version bumps: package, plugin, marketplace, skill_version, and the maintainer command examples in CLAUDE.md. The live-CDN state paragraph deliberately stays 0.3.13 until the release publishes.

Test plan

• npm test — 42/42 (unit + offline fixture-CDN e2e)
• shellcheck install.sh scripts/smoke-test.sh skills/tinycloud/scripts/preflight.sh clean
• claude plugin validate . passes
• tinycloud-skill.json required_features and preflight's REQUIRED_FEATURES are byte-identical (25 features) — the check CI diffs
• Behavior verified end-to-end against the live API from a 0.3.14 build, including a Slackbot-user-agent matrix over all six public/private × on/off combinations for both sites and video shares: opted-in cases return a full OG card (private ones with noindex), non-opted-in private cases return no metadata and no site content.

The live-CDN CI legs (Install + smoke, npx-against-CDN) don't run on PRs and will stay red-by-absence until 0.3.14 is on the CDN — expected for a floor-raise PR.

---

Note

Medium Risk
Raising min_version to 0.3.14 breaks the skill for anyone on older stable until the CDN ships 0.3.14; doc changes also guide agents on privacy-sensitive --link-preview full behavior.

Overview
Prepares the public dist repo for tinycloud 0.3.14: bumps versions in package.json, plugin metadata, README/CLAUDE examples, and documents opt-in Open Graph link previews (publish.link.preview.v1) for agents.

Skill compatibility moves the floor from 0.3.12 → 0.3.14: tinycloud-skill.json and preflight.sh now require publish.link.preview.v1 and reject binaries below 0.3.14. Merge after CDN channels.stable is 0.3.14, or preflight fails on current stable.

Agent-facing docs teach --link-preview none|full on publish and publish video, plus --preview-title / --preview-image for private sites; public publishes should emit static og:* tags in generated HTML, while private resources need explicit opt-in with a ask the user first privacy caveat. Updates land in SKILL.md, reference/verbs.md, glossary.md, and the 0.3.14 release notes in CLAUDE.md.

^{Reviewed by Cursor Bugbot for commit f30ed21. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kdr]

@coderabbitai full review