Generate public, tokenized, self-destructing download links for files. Files are served via a local Express server exposed to the internet through a Cloudflare Tunnel.

Features

• ✅ Public access — no VPN required, works from anywhere
• ✅ One-shot links — token invalidated after first download
• ✅ Configurable TTL — link expires after N minutes (default: 60)
• ✅ Auto-cleanup — file deleted from shared/ after download or expiry
• ✅ Protected endpoints — /generate and /status require SHARE_SECRET
• ✅ Isolated directory — only files in shared/ are served, never the full workspace
• ✅ No login required for download — anyone with the link can download once

Requirements

• Node.js
• cloudflared installed and a Cloudflare Tunnel configured pointing to localhost:5050
• Set SHARE_PUBLIC_URL to your public tunnel URL (e.g. https://share.yourdomain.com)
• Set SHARE_SECRET to a strong random string (recommended)

Setup

1. Install dependencies

cd skills/share-onetime-link/scripts
npm install

2. Configure Cloudflare Tunnel

Create a tunnel in the Cloudflare Zero Trust dashboard:

• Service: http://localhost:5050
• Public hostname: e.g. share.yourdomain.com

Run the tunnel:

cloudflared tunnel run --token YOUR_TUNNEL_TOKEN

3. Start the server

SHARE_PUBLIC_URL="https://share.yourdomain.com" \
SHARE_SECRET="your-strong-random-secret" \
node skills/share-onetime-link/scripts/server.js

Or use start.sh (edit variables first):

bash skills/share-onetime-link/scripts/start.sh

Usage

Generate a link (via script)

SHARE_SECRET="your-secret" \
node skills/share-onetime-link/scripts/share-file.js /path/to/file.pdf 30
# Returns a public link valid for 30 minutes

Generate a link (via agent)

Just ask naturally:

"Share report.pdf for 20 minutes"
"Generate a download link for photo.jpg, valid 1 hour"

Check active links

curl -H "x-share-secret: your-secret" http://localhost:5050/status

Environment variables

Security notes

• /dl/:token is public by design — anyone with the link can download once
• /generate and /status are protected by SHARE_SECRET — set it before exposing publicly
• If SHARE_SECRET is not set, a warning is logged and endpoints are unprotected
• Files outside shared/ are never accessible
• Tokens are cryptographically random (32 bytes / 64 hex chars)
• TTL is enforced server-side regardless of client behavior
• Never put sensitive files in SHARED_DIR unless you intend to share them