SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillshere-now

here-now

Frontend & websites

View repository

Updated 10-15 23:42

About this skill

here.now

Skill version: 1.19.0

here.now lets agents publish websites and files to live URLs in seconds.

The core primitive is a Site: publish a file or folder and get a live URL at {slug}.here.now or a custom domain. Every Site has access control: public link (default), password, or restricted invite-only access.

here.now also includes workspaces — shared team accounts where Sites belong to the team and serve at {label}.{workspace}.here.now (see "Publish to a workspace" below).

To install or update (recommended): npx skills add heredotnow/skill --skill here-now -g

For repo-pinned/project-local installs, run the same command without -g.

Current docs

Before answering questions about here.now capabilities, features, or workflows, read the current docs:

→ https://here.now/docs

Read the docs:

  • at the first here.now-related interaction in a conversation
  • any time the user asks how to do something
  • any time the user asks what is possible, supported, or recommended
  • before telling the user a feature is unsupported

Topics that require current docs (do not rely on local skill text alone):

  • Site access control (passwords and restricted access)
  • workspaces (team accounts, membership, label URLs)
  • Drives and Drive sharing
  • custom domains
  • Site Data
  • public profiles
  • proxy routes and service variables
  • limits and quotas
  • SPA routing
  • owner Site search
  • Site analytics
  • Site version history, previews, and rollback
  • error handling and remediation
  • feature availability

If docs and live API behavior disagree, trust the live API behavior.

If the docs fetch fails or times out, continue with the local skill and live API/script output. Prefer live API behavior for active operations.

Requirements

  • Required binaries: curl, file, jq
  • Optional environment variable: $HERENOW_API_KEY
  • Optional Drive token variable: $HERENOW_DRIVE_TOKEN
  • Optional credentials file: ~/.herenow/credentials
  • Bundled helpers:
    • ./scripts/publish.sh for publishing sites
    • ./scripts/drive.sh for private Drive storage

Account

If $HERENOW_API_KEY or ~/.herenow/credentials exists, use it. The publish script already loads that key. Do not ask for an email and do not create an account.

If no credentials exist, publish anyway. An anonymous 24h site is fine. Do not start a sign-in flow on your own. If the user asks to authenticate, follow https://here.now/docs and ask which email to use.

Drive and workspace publishes need a key. If none exists, say so and skip those instead of signing in.

Create a site

./scripts/publish.sh {file-or-dir}

Outputs the live URL (e.g. https://bright-canvas-a7k2.here.now/).

Under the hood this is a three-step flow: create/update -> upload files -> finalize. A site is not live until finalize succeeds.

A saved API key makes the site permanent on that account. Without one, the site is anonymous and expires in 24 hours.

File structure: For HTML sites, place index.html at the root of the directory you publish, not inside a subdirectory. The directory's contents become the site root. For example, publish my-site/ where my-site/index.html exists — don't publish a parent folder that contains my-site/.

You can also publish raw files without any HTML. Single files get a rich auto-viewer (images, PDF, video, audio). Multiple files get an auto-generated directory listing with folder navigation and an image gallery.

Update an existing site

./scripts/publish.sh {file-or-dir} --slug {slug}

The script auto-loads the claimToken from .herenow/state.json when updating anonymous sites. Pass --claim-token {token} to override.

Authenticated updates require a saved API key.

Every publish records an immutable version. If the user asks to see earlier versions of a Site, undo a publish, or roll back: list history with GET /api/v1/publish/{slug}/versions and restore instantly with POST /api/v1/publish/{slug}/versions/{versionId}/restore (restoring keeps the current access mode, password, and domains). Version access requires a paid plan and is included for workspace Sites; free accounts' history is recorded and unlocks on upgrade. A byte-identical republish returns unchanged: true from finalize instead of creating a new version. See https://here.now/docs#versions.

Signed-in users also have public profiles. Agents can help users show or hide Sites on their profile and manage profile settings through the API documented at https://here.now/docs#profile.

Publish to a workspace

Workspaces are shared team accounts: Sites published into one belong to the team, not the publishing member, and get a memorable URL at {label}.{workspace}.here.now.

./scripts/publish.sh {file-or-dir} --workspace {subdomain}

Requires a saved API key and membership in the workspace. List the user's workspaces (and valid subdomains) with GET /api/v1/accounts. Workspace Sites default to member-only access; the script reports the team URL as publish_result.account_url.

For everything else — creating workspaces, invites and auto-join, workspace domains and variables, label renames — read the current docs:

→ https://here.now/docs#workspaces

Site access control

A Site uses one access mode at a time:

  • anyone_with_link (default): anyone with the URL can view.
  • password: visitors must enter a shared password.
  • restricted: invite-only; only verified email addresses or email domains the owner allows can view.

Workspace-owned Sites use a different set of modes: account_members (the default — visitors sign in and must be workspace members) or public, optionally with a password. restricted allowlists are personal-Site-only and return 409 workspace_access_mode_unsupported on workspace Sites. See https://here.now/docs#workspace-access.

Manage access with GET/PATCH /api/v1/publish/{slug}/access (passwords via the metadata endpoint). Restricted access requires a claimed Site. The PATCH replaces the full allowlists — read, merge, then write. Before working with access control, read the current docs:

→ https://here.now/docs#access-control

Use a Drive

Use a Drive when the user wants private cloud storage for agent files: documents, context, memory, plans, assets, media, research, code, and anything else that should persist without being published as a website.

Every signed-in account has a default Drive named My Drive.

./scripts/drive.sh default
./scripts/drive.sh ls My Drive
./scripts/drive.sh put My Drive notes/today.md --from ./notes/today.md
./scripts/drive.sh cat My Drive notes/today.md
./scripts/drive.sh share My Drive --perms write --prefix notes/ --ttl 7d

Use scoped Drive tokens for agent-to-agent handoff. If you receive a herenow_drive share block, use its token as Authorization: Bearer <token> against api_base, respect pathPrefix when present, and preserve ETags on writes. A pathPrefix of null means full-Drive access. If the skill is available, prefer ./scripts/drive.sh; otherwise call the listed API operations directly.

Client attribution

Pass --client so here.now can track reliability by agent:

./scripts/publish.sh {file-or-dir} --client cursor

This sends X-HereNow-Client: cursor/publish-sh on publish API calls. If omitted, the script sends a fallback value.

API key storage

The publish script reads the API key from these sources (first match wins):

  1. --api-key {key} flag (CI/scripting only — avoid in interactive use)
  2. $HERENOW_API_KEY environment variable
  3. ~/.herenow/credentials file (recommended for agents)

To store a key, write it to the credentials file:

mkdir -p ~/.herenow && echo "{API_KEY}" > ~/.herenow/credentials && chmod 600 ~/.herenow/credentials

IMPORTANT: After receiving an API key, save it immediately — run the command above yourself. Do not ask the user to run it manually. Avoid passing the key via CLI flags (e.g. --api-key) in interactive sessions; the credentials file is the preferred storage method.

Never commit credentials or local state files (~/.herenow/credentials, .herenow/state.json) to source control.

State file

After every site create/update, the script writes to .herenow/state.json in the working directory:

{
  "publishes": {
    "bright-canvas-a7k2": {
      "siteUrl": "https://bright-canvas-a7k2.here.now/",
      "claimToken": "abc123",
      "claimUrl": "https://here.now/claim?slug=bright-canvas-a7k2&token=abc123",
      "expiresAt": "2026-02-18T01:00:00.000Z"
    }
  }
}

Before creating or updating sites, you may check this file to find prior slugs. Treat .herenow/state.json as internal cache only. Never present this local file path as a URL, and never use it as source of truth for auth mode, expiry, or claim URL.

What to tell the user

For published sites:

  • Always share the siteUrl from the current script run.
  • Read and follow publish_result.* lines from script stderr to determine auth mode.
  • When publish_result.account_url is non-empty (workspace publishes), share it as the primary team URL alongside siteUrl.
  • When publish_result.auth_mode=authenticated: tell the user the site is permanent and saved to their account. No claim URL is needed.
  • When publish_result.auth_mode=anonymous: tell the user the site is temporary (24h) and not saved to an account.
  • Never tell the user to inspect .herenow/state.json for claim URLs or auth status.

For Drives:

  • Do not describe Drive files as public URLs.
  • Tell the user Drive contents are private unless shared with a scoped token.
  • When sharing access with another agent, prefer a scoped token with a narrow pathPrefix and short TTL.

publish.sh options

Flag Description
--slug {slug} Update an existing site instead of creating
--workspace {subdomain} Publish into a workspace (team account) you belong to
--claim-token {token} Override claim token for anonymous updates
--title {text} Viewer title (non-HTML sites)
--description {text} Viewer description
--ttl {seconds} Set expiry (authenticated only)
--client {name} Agent name for attribution (e.g. cursor)
--base-url {url} API base URL (default: https://here.now)
--allow-nonherenow-base-url Allow sending auth to non-default --base-url
--api-key {key} API key override (prefer credentials file)
--spa Enable SPA routing (serve index.html for unknown paths)

Beyond publish.sh

For Drive operations, use ./scripts/drive.sh or the Drive API. For broader account and Site management — Site Data, search, analytics, profiles, delete, metadata, access control, domains, variables, proxy routes, duplication, and more — see the current docs:

→ https://here.now/docs

Full docs: https://here.now/docs