stitch-upload

Upload Local Assets to Stitch

Quick Start

1. "Upload the desensitized store booking page HTML; first provide locally reviewable results."
2. "Upload the brand DESIGN.md for system creation; retain the existing scope and source."
3. "Upload the user-provided presentation PNG; indicate missing inputs and verification status."

For designers, front-end developers, and teams maintaining this process. Designers provide intent and assets, developers provide engineering/tooling, and the team preserves source and acceptance status during handoff.

Capability Boundaries

✅ Good at handling

• Upload the desensitized store booking page HTML.
• Route the brand DESIGN.md to MCP upload_design_md。
• Upload the user-provided presentation PNG.

⚠️ Requires assets

• A real projectId.
• A reviewed local file in a supported format.
• Credentials and upload authorization read via platform_secret_provider() .

❌ Inapplicable scenarios and handoff

• Remotely apply a design system → stitch-manage-design-system.
• Generate an upload file from code → stitch-code-to-design.
• Publicly deploy a website → target deployment process, deliver the HTML asset package.

Workflow

1. Verify the file path, size, type, and target project, ensuring authorization covers these.
2. The image/HTML script uses a credentials chain with environment first and user configuration fallback via platform_secret_provider() ; the CLI does not accept keys or service root address parameters.
3. Markdown does not use the private REST script; after reading the file, encode it in-process and call the current MCP upload_design_md。
4. Private REST is pinned to https://stitch.googleapis.com and sent once; redirects and automatic retries are prohibited.
5. Reconcile using the project resource name from get_project , the pure project ID fromlist_screens , and theget_screen from name: projects/{project}/screens/{screen} .

Order by dependency: source verification → local artifacts → authorized external operations → verification handoff. For multiple tasks, follow the current main path first; when information is missing, output an assumption draft first, then precisely list what is missing and its purpose, without using vague prompts like "please provide more context".

Security and Result Verification

Do not read unrelated account configurations or collect user passwords; credentials are provided only by the environment or authorized connectors. Examples use only demo data; before uploading, replace customer names, phone numbers, and order numbers with demo values, and check HTML, screenshots, and file metadata. Do not write keys, session cookies, full base64 text, or signed download URLs into reports/repositories. Unverified parameters, visuals, or business figures must not be fabricated; outputs should note the source, decision basis, actual execution, and unverified parts.

• argv/logs/reports contain no keys, base64, or full responses.
• PNG/JPG/JPEG/WEBP map to screenshot, HTML/HTM map to htmlCode; Markdown uses upload_design_md。
• REST accepts only the current results[].screen response and outputs the validated screen name.

Customizable: title, generated-by, file path. The service root address is not customizable. Value-added checks: configure credentials; hand off small output IDs; no automatic retries or redirects.

FAQ

Q1: What is the main deliverable? Local HTML requests use htmlCode, text/html, and DOCUMENT; after remote execution, only deliver screen/instance identifiers that have passed type, format, and project ownership validation. For the complete offline input, request, and simulated receipt, see the local application example; constructing a request does not mean the upload succeeded.

Q2: When should a different entry point be used instead? Apply a design system remotely → stitch-manage-design-system; generate an upload file from code → stitch-code-to-design; publicly deploy a website → the target deployment process, delivering an HTML asset package.

Q3: What happens if input is missing? First provide a clearly marked local assumptions draft, and list "Needs to be supplied: the real projectId; reviewed local files in a supported format; STITCH_API_KEY and upload authorization injected through the runtime environment." Write operations that depend on these inputs are not executed.

Q4: How is completion determined? argv/logs/reports contain no secrets, base64, or full responses; local REST and remote Markdown paths are separated; the returned screen name has been reconciled read-only.

Q5: How can it be customized? title, generated-by, file paths; the service root address is fixed to the official Google origin.

Q6: Does it automatically upload, install, or go live? Only perform actions covered by the current request and existing authorization; without a remote receipt, do not claim the upload succeeded, and without runtime verification, do not claim it is live. Additional installation or scope expansion requires first explaining the specific impact.

Reference as needed

• When executing detailed mappings, API, or templates, read Extended Process。
• When encountering failures or abnormal input, read Anti-patterns and Gotchas。
• When edge cases, compatibility, customization, and authorization are involved, read In-depth FAQ。
• When complete input/output and verification scenarios are needed, read Local Application Example。
• The basis for the local implementation is the current skill's accompanying source code and fixed upstream snapshot; the structure follows the Agent Skills specification. The tool's current behavior is subject to the actual schema; when not connected, do not claim online behavior has been verified.

When to use

Load this skill when the user needs to perform generation or write operations after clear inputs, budget, and delivery constraints are established . First extract the goal, inputs, constraints, delivery format, and acceptance criteria from the request; the description summary is: Safely upload authorized local images or HTML to a specified Stitch project, and route Markdown to the remote upload_design_md; do not trigger it when only generating local files, retrieving a project, or deploying a website..

Rules

• Read before write: first confirm the current state and real capabilities, then perform actions that change external state.
• Least privilege: use only the files, tools, accounts, and network scope required to complete the current step.
• Evidence first: when run results, resource IDs, versions, hashes, or test output are missing, clearly mark them as NOT_VERIFIED。
• Idempotency first: retain request identifiers and stage status; when the result is unclear, query first rather than blindly retrying.
• Privacy and security: logs, examples, receipts, and error messages must not contain tokens, cookies, secrets, or personally sensitive data.

Workflow

Step 1: Clarify the intent

Confirm whether this skill matches the goal; if it is only an adjacent need, hand it off to a more precise skill.

Step 2: Perform prechecks

Validate the input, model/tool capabilities, output path, budget cap, and approval status; stop at the read-only stage when any key condition is unknown.

Step 3: Form a plan

List the tools to be invoked, the objects that will be changed, the success criteria, and the safe exit method after failure.

Step 4: Execute actions

Execute per a single approval and record the request identifier; for ambiguous results, query first rather than resubmit; keep a correlatable status or receipt for every external call.

Step 5: Verify delivery

Verify artifact existence, format, hash/identifier, cost status, and quality gates, and state facts, inferences, and unverified items separately.

Validation checklist

• The skill trigger conditions match the user's intent, and no adjacent task was misrouted to this skill.
• The input, target object, version, and output location are all specified, and no required value has been replaced by a guessed value.
• All writes, payments, publications, or irreversible actions are within the scope of user authorization.
• The results have been verified with independent checks; "command succeeded" or "file exists" alone does not count as complete acceptance.
• The output includes actual evidence, failed/skipped items, remaining risks, and executable next steps.

Gotchas

1. Mistaking the plan for the result: A document or prompt does not equal actual execution; the actual execution level must be indicated.
2. Erroneous retry: A timeout or lost response may already have produced remote state; query first before deciding whether to retry.
3. Implicit scope expansion: Batch, full-scale, publish, overwrite, and paid operations are not natural extensions of ordinary reads and writes.
4. Version drift: When referencing external resources, record the version, tag, or commit; do not treat a mutable branch as release evidence.
5. Stale evidence: Caches, old screenshots, and historical tests cannot prove the current environment; refresh key evidence before delivery.

Non-applicability and boundaries

Payment, publication, overwrite, upload, or external writes must use the explicit authorization of the current task; do not automatically expand the number of times or the budget. If the request requires another skill, do not copy its content; hand off by skill name and preserve the current task context.

Progressive disclosure

• When it is necessary to determine input/output, status, and authorization points, read references/workflow-contract.md。
• When pre-delivery self-check is needed, read references/validation-checklist.md。
• When encountering timeout, partial success, or recovery scenarios, read references/error-recovery.md。
• For first run, refusal of privilege escalation, and failure recovery, refer respectively to examples/happy-path.md、examples/boundary-refusal.md、examples/failure-recovery.md。