{"id":48046,"plugin_id":"plugin_asdk_app_6acd1aa56f948191ab40d2bdb1fd5050","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-10-24T13:35:20.561Z","digest":"eaef26836be24e5ba9ce873267c778442b79678bbbe4ee1ab7cf30e038454c55","against":null,"payload":{"description":"Create or edit a mobile app in ChatGPT Work's cloud coding workspace, build it with revyl build --remote, run cloud tests and device verification, and map it with revyl explore. Also use for other explicitly requested Revyl CLI operations through the bundled launcher.","included_files":[],"name":"revyl-cloud-app","skill_md_contents":"---\nname: revyl-cloud-app\ndescription: Create or edit a mobile app in ChatGPT Work's cloud coding workspace, build it with revyl build --remote, run cloud tests and device verification, and map it with revyl explore. Also use for other explicitly requested Revyl CLI operations through the bundled launcher.\n---\n\n# Revyl Cloud App\n\nUse ChatGPT Work or another shell-capable coding host for source work. Revyl\nprovides remote builds, devices, tests, and exploration; installing this plugin\ndoes not create a coding workspace or grant repository access. Confirm that\nthe host exposes a writable workspace, shell, outbound network access, and a\nway to inspect images. If any required capability is missing, report it and\nask the user to enable the cloud coding workspace. Do not substitute an MCP\nserver's filesystem for the user's workspace or send arbitrary shell commands\nto MCP. An unavailable embedded viewer does not block authorized CLI work.\n\nFor an existing development loop, use `revyl-codex-dev-loop`. For proof of an\nexisting CI artifact, use `revyl-codex-proof-ci`; do not rebuild it. For viewing\nonly, use `revyl-workspace`; do not start a build or exploration just to open\nAtlas. This workflow owns standalone builds, verification sessions, tests, and\nexploration runs, and must not duplicate another workflow's resources.\n\n## Resolve the full CLI and authenticate\n\nResolve this skill's absolute directory before changing to the app directory:\n\n```sh\nSKILL_DIR=\"<absolute directory containing this SKILL.md>\"\nLAUNCHER=\"$(cd \"$SKILL_DIR/../../scripts\" && pwd)/launch-revyl\"\n\"$LAUNCHER\" --version\n\"$LAUNCHER\" auth status\n```\n\nOn Windows, use the absolute `../../scripts/launch-revyl.cmd` path instead.\nInvoke this launcher for every Revyl command, never `revyl` from PATH or a\ndifferent installation. It exposes the complete pinned CLI, not a fixed\ncommand subset. Discover other requested operations through\n`\"$LAUNCHER\" <command> --help` and `\"$LAUNCHER\" schema --format llm`.\nUse that runtime's contract, not flags from newer documentation. A missing\ncommand requires a reviewed runtime update, not an unpinned download.\n\nWhen unauthenticated, run `\"$LAUNCHER\" auth login`, share its normal approval\nURL, and wait for the user to approve. Never ask for credentials in chat or\ncopy them from the MCP connection. Never invoke credential-provisioning,\nsecret-bridge, or auth-bypass commands. CLI and embedded-browser sign-in are\nseparate; both must authorize the same app and session before embedding.\n\n## Establish source, target, and spending scope\n\nConfirm the requested app, target environment, platform, and authorized work.\nAuthorization to edit source is not authorization to publish it, create remote\napps/tests, run paid builds/devices/explorers, or change organization settings.\nAgree on build attempts, test runs, explorer count, and duration before paid\nwork; do not repeatedly retry a failed build or increase concurrency without\napproval. One end-to-end approval can cover the explicitly named operations.\n\nFor a new app, create its source in the cloud workspace using the requested\nframework and its supported scaffolding tools. For an existing app, use the\nauthorized checkout. Inspect repository instructions and run relevant local\nchecks. Preserve unrelated files. Establish a Git worktree when required by\nthe build contract, but do not commit or push without authorization.\n\nRun from the app directory containing `.revyl/config.yaml`. If absent and\nsetup is authorized, run `\"$LAUNCHER\" init -y`, inspect the detected recipe,\nand configure its exact profile, platform, build steps, and output for the\nactual framework. Do not overwrite an existing config with `--force`.\nResolve the app using `\"$LAUNCHER\" app list --json`. Only when explicitly\nauthorized to create a new remote app, use\n`\"$LAUNCHER\" app create --name <name> --platform <ios-or-android> --json`.\nUse its returned app ID in the selected recipe, then run\n`\"$LAUNCHER\" config validate`. Do not publish configuration with `config push`\nunless separately requested. Keep secrets out of source, config, argv, and\nevidence; use established encrypted build-secret and launch-variable references.\n\n## Build remotely, then verify that exact artifact\n\nRead `build --help` from the pinned runtime, then submit one authorized build:\n\n```sh\n\"$LAUNCHER\" build --remote --profile <profile> --platform <ios-or-android> \\\n  --timeout 1800 --detach --no-set-current --json\n\"$LAUNCHER\" build status <returned-build-job-id> --json\n```\n\nUse the agreed timeout if different. `--remote` moves compilation to Revyl,\nbut the CLI still needs the source checkout and recipe to submit the build.\nRetain the returned job ID and source revision/worktree state. Poll that job\nat intervals of at least five seconds, with a total deadline matching the\nbuild timeout plus a bounded completion allowance. A queued job is not a\nsuccessful build. Read its terminal result and artifact ID; never substitute\nthe app's latest build. Do not automatically retry an ambiguous submission.\nOn failure, inspect the reported logs before making an authorized correction.\nOn cancellation or deadline, cancel only the owned job with\n`\"$LAUNCHER\" build cancel <job-id> --json` and check its final status.\n\nStart verification on the successful build, without changing the app's current\nversion or opening a browser from the shell:\n\n```sh\n\"$LAUNCHER\" device start --build-version-id <returned-build-version-id> \\\n  --platform <ios-or-android> --timeout 900 --open=false --json\n\"$LAUNCHER\" device screenshot -s <returned-session-id> --out <image-path>\n\"$LAUNCHER\" device validation -s <returned-session-id> \"<expected visible behavior>\" --json\n\"$LAUNCHER\" device report -s <returned-session-id> --json\n```\n\nReturn the viewer URL promptly. If `open_revyl_workspace` is available, request\nthis same session with `view=\"device\"` and its session ID; do not start another\nsession through MCP. Present its returned `chatgpt_url`, when available, as an\n**Open in ChatGPT** link. The user clicks it to navigate the persistent panel;\na successful tool call is not proof that the viewer is visible or playing.\nDiscover `device instruction`, interaction, and extraction\ncommands through their help as needed. Pass the returned server-issued session\nID to every session-scoped command. Open screenshots before describing them;\nmissing or false validation results are not a pass.\n\nAlways stop the owned verification session with\n`\"$LAUNCHER\" device stop -s <session-id> --json`, including after failure.\nConfirm termination using `device list --json` and session status as needed.\nNever use `--all`. Report pending cleanup rather than claiming release.\n\n## Create and run reproducible tests when requested\n\nUse the pinned `schema --format llm` to author supported YAML, not guessed\nblocks. With permission to create a persisted test, use\n`\"$LAUNCHER\" test create --from-file <yaml-path> --no-open --json`; inspect\n`test create --help` for app/platform association. Do not use `--force` to\nreplace another test. Run an authorized existing or newly created test against\nthe same successful artifact:\n\n```sh\n\"$LAUNCHER\" test run <test-id> --build-id <build-version-id> --no-wait --no-open --json\n\"$LAUNCHER\" test report <returned-task-id> --json\n```\n\nPoll the returned task's report, not `test status <test-id>`: that command\nselects the latest execution, which can belong to somebody else. Use a bounded\ndeadline and cancel the owned task with `test cancel <task-id>` if needed.\nRequire terminal test results; a successful submission is not a passed test.\nDo not use `--build` here: the artifact was already built remotely. Do not\ndelete persisted tests or publish/share reports as automatic cleanup.\n\n## Explore and map the same build\n\nExploration launches its own cloud agents/devices and needs explicit spending\nauthorization. Release the standalone verification session before launching\nexplorers unless overlapping capacity was explicitly approved.\n\n```sh\n\"$LAUNCHER\" explore run <app-id> --build-id <build-version-id> \\\n  --explorers <approved-count> --max-duration <approved-duration> \\\n  --no-wait --json\n\"$LAUNCHER\" explore status <returned-run-id> --json\n```\n\nDo not silently use the default three explorers. Supply authentication through\nstored launch-variable references; do not put credentials in instructions or\n`--auth-instructions`. Poll at least five seconds apart within an agreed total\ndeadline that includes Atlas processing. Inspect both execution and Atlas\nstatus, actual explorer count, findings, and the returned report URL. Completed\ndevice exploration is not proof that Atlas processing completed. If the user\ncancels or the deadline expires, use\n`\"$LAUNCHER\" explore cancel <run-id> --json` and confirm terminal status.\n\nWhen mapping is complete, use `open_revyl_workspace(view=\"atlas\", app_id=...)`\nif available and present its `chatgpt_url` when returned. Otherwise return the authenticated report URL from the CLI;\nnever invent a tool, claim an iframe loaded, or publish a share to bypass\naccess controls. A failed exploration can still leave partial evidence; label\nit accurately instead of claiming a complete map.\n\n## Other CLI operations and handoff\n\nThe full CLI is available through the launcher in this workspace. Apply the\nsame authentication, environment, authorization, and bounded-operation rules\nto every discovered command. Availability does not authorize destructive,\nadministrative, sharing, release, or secret-management operations. Do not\nexpose an unrestricted shared-server shell as an alternative.\n\nReport source changes and where they are saved, build job/artifact IDs, actual\ntest and validation results, exploration/Atlas outcomes, and cleanup status.\nDistinguish work not run from failures. Keep credentials, signed media URLs,\ncustomer content, and private logs out of public artifacts. Only publish source\nor evidence through an explicitly authorized destination.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}