Add ChatGPT app submission metadata

.agents/skills/vapor/SKILL.md

@@ -0,0 +1 @@
+../../../plugin/skills/vapor/SKILL.md

.claude-plugin/marketplace.json

@@ -0,0 +1,15 @@
+{
+  "name": "vapor",
+  "owner": {
+    "name": "Nicholas Jitkoff",
+    "url": "https://github.com/arfct"
+  },
+  "description": "vapor \u2014 live markdown documents people and agents review together",
+  "plugins": [
+    {
+      "name": "vapor",
+      "source": "./plugin",
+      "description": "Draft plans and documents on vapor \u2014 live markdown people and agents review together, exported to the repo before the doc expires."
+    }
+  ]
+}

.dev.vars.example

@@ -1,3 +1,34 @@
-# Fathom analytics (optional — omit to disable)
+# Local development variables. Copy to .dev.vars (git-ignored); everything
+# is optional and the app runs anonymous-only with none of them set.
+
+# Identity (docs/self-hosting.md, "Sign-in providers"). Set either, both,
+# or neither; with neither the instance is anonymous-only.
+# GOOGLE_CLIENT_ID is the public OAuth client id of a Google "Web
+# application" credential whose authorized JavaScript origins include
+# http://localhost:5173. APPLE_CLIENT_ID is a Sign in with Apple Services ID
+# whose return URLs include http://localhost:5173/auth/apple — note Apple
+# only allows https return URLs, so Apple sign-in is usually tested on a
+# deployed preview rather than on localhost. SESSION_SECRET signs session
+# JWTs; any long random string works locally:
+#   openssl rand -base64 32
+GOOGLE_CLIENT_ID=
+APPLE_CLIENT_ID=
+SESSION_SECRET=
+
+# Instance identity (app/shared/site.ts). Normally left unset locally: the
+# request's own origin (http://localhost:5173) is used everywhere.
+# PUBLIC_ORIGIN=
+# REDIRECT_HOSTS=
+# OPERATOR_NAME=
+# SOURCE_URL=
+
+# Send to Kindle by email (docs/self-hosting.md). Both or neither.
+# RESEND_API_KEY=
+# SEND_FROM_EMAIL=
+
+# Domain verification for listing the MCP server in ChatGPT's plugin directory (docs/self-hosting.md)
+# OPENAI_APPS_CHALLENGE=
+
+# Fathom analytics (omit to disable)
 VITE_FATHOM_SITE_ID=
 VITE_FATHOM_DOMAINS=

.github/workflows/deploy.yml

@@ -0,0 +1,50 @@
+# Deploys to Cloudflare Workers from GitHub. Off until you add two repository
+# secrets (Settings → Secrets and variables → Actions):
+#
+#   CLOUDFLARE_API_TOKEN   an API token with the "Edit Cloudflare Workers"
+#                          template (plus R2 write if you let it create the bucket)
+#   CLOUDFLARE_ACCOUNT_ID  from the Workers overview page's sidebar
+#
+# Optional repository *variable* WRANGLER_CONFIG points the build at another
+# wrangler config (the reference instance uses deploy/vapor.fyi.jsonc). With
+# the secrets absent the job runs and skips, so a fork without them stays green.
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: deploy
+    runs-on: ubuntu-latest
+    env:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      WRANGLER_CONFIG: ${{ vars.WRANGLER_CONFIG }}
+    steps:
+      - name: Check for Cloudflare credentials
+        id: creds
+        run: |
+          if [ -n "$CLOUDFLARE_API_TOKEN" ] && [ -n "$CLOUDFLARE_ACCOUNT_ID" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID secrets; skipping deploy."
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: actions/checkout@v4
+        if: steps.creds.outputs.present == 'true'
+      - uses: actions/setup-node@v4
+        if: steps.creds.outputs.present == 'true'
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+        if: steps.creds.outputs.present == 'true'
+      - run: npm run deploy
+        if: steps.creds.outputs.present == 'true'

.gitignore

@@ -21,3 +21,4 @@ worker-configuration.d.ts
 
 # Coverage
 /coverage/
+.superpowers/

.nvmrc

@@ -0,0 +1 @@
+22

README.md

@@ -1,95 +1,115 @@
-# mist
+# vapor
 
-Collaborative markdown editor. A cross between GitHub Gist and Google Docs — share and do multiplayer editing on markdown documents, quickly.
+You paste a draft into chat and now there are two copies, both going stale. vapor gives the draft one URL instead: a live markdown document anyone can open and edit, people and AI agents side by side, each with a cursor. It deletes itself after 99 hours.
 
-Everything is public by URL. Documents persist live with no save button. Multiple users see each other's cursors in real time.
+vapor is a single Cloudflare Worker you can run yourself: see [Running your own vapor](docs/self-hosting.md). The reference instance is [vapor.fyi](https://vapor.fyi); the examples below use it, and every command works the same against your own origin. A fork of [mist](https://github.com/inanimate-tech/mist).
 
-## Features
+## Documents
 
-- **Real-time multiplayer editing** via TipTap + Yjs, backed by Cloudflare Durable Objects
-- **Live markdown formatting** — inline styles render as you type, with formatting characters shown in grey
-- **Suggest mode** — track changes using CriticMarkup (additions, deletions, comments, highlights)
-- **Threaded comments** with highlight anchoring
-- **Preview mode** — rendered markdown with click, hover, or keypress toggle
-- **CLI upload** — `curl https://your-domain/new -T file.md`
-- **Drag and drop** `.md` files to create new documents
-- **Dark/light/auto themes**
-- **Documents auto-expire** after 99 hours
+Anyone with the URL can read and edit. Live markdown with track changes (CriticMarkup), comments anchored to highlights, and a rendered preview. No accounts required, no save button, nothing kept past 99 hours—export before then.
 
-## Tech stack
+```bash
+curl https://vapor.fyi/new -T notes.md    # create from a file; the URL carries the title: /my-notes-<id>
+curl https://vapor.fyi/<id>.md            # raw markdown back (with or without the slug)
+```
 
-- [Cloudflare Workers](https://developers.cloudflare.com/workers/) + [Durable Objects](https://developers.cloudflare.com/durable-objects/) (backend + persistence)
-- [Cloudflare Agents SDK](https://developers.cloudflare.com/agents/) (real-time WebSocket agent)
-- [React Router 7](https://reactrouter.com/) (SSR)
-- [TipTap 3](https://tiptap.dev/) (editor)
-- [Yjs](https://yjs.dev/) (CRDT for multiplayer)
-- [Tailwind CSS 4](https://tailwindcss.com/) (styling)
-- TypeScript, Vitest
+## Reading it elsewhere
 
-## Getting started
+Every document is also an EPUB at `/<id>.epub`, with tracked changes accepted, comments left out, and images embedded, set in the same sans type as the page; `/<id>/print` is the same copy as a printable page for Save as PDF. Share → Send to device sends it: to a **Kindle** by email once you have saved your Send-to-Kindle address (the instance needs an email sender; see the self-hosting guide), or to a **reMarkable** through its cloud after a one-time pairing code. Download EPUB works for anyone, signed in or not.
 
-### Prerequisites
+## People and agents
 
-- Node.js 22+ (see `.nvmrc`)
-- A Cloudflare account (free tier works)
+Sign-in (Google or Apple) is optional and only changes attribution:
 
-### Setup
+| | Human | Agent |
+|---|---|---|
+| Anonymous | Curious Ladybug 🐞 | Agentic Butterfly 🦋 |
+| Signed in | Ada Lovelace | Ada's Claude |
 
-```bash
-git clone https://github.com/inanimate-tech/mist.git
-cd mist
-npm install
-```
+Your anonymous animal lives in localStorage and follows you between documents. Sign in and your name takes over, earlier comments included. People are circles; agents are hexagons carrying the mark of the client they connected from, in their owner's colour. Your email never appears in a document: mentions carry a short public id, and `@` completion shows names.
+
+## Connecting an agent
 
-### Development
+vapor is an [MCP](https://modelcontextprotocol.io) server. Two ways in:
 
 ```bash
-npm run dev
+# signed in: stable identity, write access if you grant it
+claude mcp add --transport http vapor https://vapor.fyi/mcp
+
+# anonymous: no setup, suggest and comment only
+claude mcp add --transport http vapor https://vapor.fyi/mcp/anonymous
 ```
 
-### Deploy
+The same URL works in claude.ai, ChatGPT (developer mode), Codex CLI, Cursor, Gemini CLI, and VS Code. Every instance serves its own guide at `/mcp` (and `/llms.txt` for agents) with the snippet for each client, and every document's Share → Invite an agent dialog has the same.
 
-Set your Cloudflare account ID via environment variable:
+Agents get suggest and comment by default; full write is a separate grant on the consent screen. For a headless machine or a fleet of harnesses, a signed-in person can mint a personal access token (Share → Invite an agent → Other) and send it as a bearer instead of doing the OAuth dance per install. Their edits type in at human pace with a visible cursor (`pace: "instant"` skips the show). Each document's Agents panel lists who's enrolled, with revoke.
+
+Tools: `read_document` · `insert` · `replace` · `suggest` · `comment` · `reply` · `resolve_thread` · `edit_comment` · `delete_comment` · `attach` · `create_document` · `list_documents` · `join` · `leave` · `events_poll` · `events_subscribe`. Reads carry `created_at` and `expires_at`, and `document.expiring` fires six hours before a document deletes itself. A comment with a `quote` attaches to that text exactly like one made in the browser. Attachments (images inline, other files as a chip) need the signed-in endpoint with write. Mention the agent in a document (type `@` and pick it), or reply in one of its threads, and the agent hears about it: by polling `events_poll` for a while after sharing a link, or through a signed webhook from `events_subscribe`.
+
+A fenced block whose language is `agent` carries standing guidance for agents. People see it as a labelled panel in the editor; each block records who last edited it, and `read_document` returns it as `instructions` framed as untrusted document content — it shapes how an agent works in that document, never what it may do outside it.
+
+To have a mention wake an agent that isn't running anywhere, sign in and set a wake target once under Share → Invite an agent, in the Claude tab (routine) or the Other tab (webhook): a [Claude Code routine](https://code.claude.com/docs/en/routines)'s fire URL and token, or an HTTPS webhook. Every mention of your agent, and every reply in its threads, in any document it is on, fires it. The canonical routine prompt is at the end of the `/mcp` guide. Design in [the wake plan](docs/plans/2026-09-06-agent-wake-plan.md).
+
+## The drafting habit
+
+The vapor plugin for Claude Code bundles the MCP connection with a skill that changes where drafts live: plans and proposals go up as vapor docs instead of chat walls, Claude answers comments over MCP, and the settled document is exported to the repo before the 99-hour cliff. The bundled connection is the reference instance's signed-in endpoint — the first tool call prompts a Google sign-in and consent screen.
 
 ```bash
-export CLOUDFLARE_ACCOUNT_ID=your-account-id
-npm run deploy
+claude plugin marketplace add arfct/vapor
+claude plugin install vapor@vapor
 ```
 
-### Optional: Analytics
-
-To enable [Fathom](https://usefathom.com/) analytics, set these environment variables (or add to `.dev.vars`):
+Just the skill, no plugin: every instance serves it at `/skill.md`, addressed to that instance (source in [`plugin/skills/vapor/SKILL.md`](plugin/skills/vapor/SKILL.md)):
 
+```bash
+curl -s https://vapor.fyi/skill.md --create-dirs -o ~/.claude/skills/vapor/SKILL.md
 ```
-VITE_FATHOM_SITE_ID=your-site-id
-VITE_FATHOM_DOMAINS=your-domain.com
+
+The skill is in the [Agent Skills](https://agentskills.io) format, so the same file works elsewhere. Codex CLI, Cursor, and GitHub Copilot all read `~/.agents/skills/`; Gemini CLI takes the whole thing, connection included, as an extension:
+
+```bash
+curl -s https://vapor.fyi/skill.md --create-dirs -o ~/.agents/skills/vapor/SKILL.md
+gemini extensions install https://github.com/arfct/vapor
 ```
 
-### Commands
+In a repository, `.agents/skills/vapor/SKILL.md` (a symlink here) gives every contributor's agent the workflow. `gemini-extension.json` and `skills/` at the root exist for the Gemini install and point at the same file. Running a fork and want the plugin to connect to it instead? [Shipping a plugin for your instance](docs/self-hosting.md#shipping-a-plugin-for-your-instance).
+
+## Run your own
 
 ```bash
-npm run dev          # Local development server
-npm run build        # Production build
-npm run deploy       # Build and deploy to Cloudflare Workers
-npm run typecheck    # TypeScript type checking
-npm run lint         # ESLint
-npm run test         # Vitest with coverage
-npm run test:watch   # Vitest in watch mode
+git clone https://github.com/arfct/vapor && cd vapor
+npm install
+npm run dev                       # http://localhost:5173, everything emulated locally
+npx wrangler login
+npx wrangler r2 bucket create vapor-attachments
+npm run deploy                    # → https://vapor.<you>.workers.dev
 ```
 
-## Project structure
+That is a working instance. A custom domain, Google sign-in, the optional instance variables (`PUBLIC_ORIGIN`, `REDIRECT_HOSTS`, `OPERATOR_NAME`, `SOURCE_URL`), deploying from GitHub Actions, and keeping a separate production config are all in [docs/self-hosting.md](docs/self-hosting.md). Nothing in the code names a host: an instance describes itself from the URL it is served at.
+
+## How it's built
+
+Each document is one Cloudflare Durable Object holding the [Yjs](https://yjs.dev/) doc, agent roster, and event log. [TipTap](https://tiptap.dev/) and [React Router 7](https://reactrouter.com/) on the front, the [Agents SDK](https://developers.cloudflare.com/agents/) underneath, and a dependency-free auth stack (Google sign-in, OAuth 2.1 with PKCE and CIMD) ported from [subpixel](https://subpixel.app).
 
 ```
-agents/       Durable Object agents (server-side document state)
-app/
-  components/ UI components
-  lib/        Editor logic, utilities, CriticMarkup, Yjs provider
-  routes/     File-based routing
-  shared/     Types and constants shared between client and server
-workers/      Cloudflare Worker entry point
-tests/        Test suite
+agents/    Durable Objects: DocumentAgent, VaporMcp, Registry
+app/       React Router app
+workers/   Worker entry, routes, OAuth server
+deploy/    Per-instance wrangler configs (the reference instance's lives here)
+tests/     Unit + integration
+```
+
+## Developing
+
+Node 22+ (`.nvmrc`).
+
+```bash
+npm install
+npm run dev      # local server
+npm run test     # also: typecheck, lint
+npm run deploy   # needs CLOUDFLARE_ACCOUNT_ID
 ```
 
-## Licence
+Sign-in needs `SESSION_SECRET` (a Workers secret) and `GOOGLE_CLIENT_ID` and/or `APPLE_CLIENT_ID` (wrangler vars); all optional in development. See `.dev.vars.example`. Design docs live in [docs/plans/](docs/plans/); the architecture in [docs/technical-architecture.md](docs/technical-architecture.md).
 
-[MIT](LICENSE)
+[Privacy](https://vapor.fyi/privacy) · [Terms](https://vapor.fyi/terms) · [MIT](LICENSE)