
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@briefroom/cli
Advanced tools
briefroom command-line interface — share AI-generated HTML, get feedback, loop back to your agent.
Command-line interface for briefroom.
npm i -g @briefroom/cli
# or use npx (no install)
npx @briefroom/cli <command>
briefroom login # Browser-based PKCE login, PAT saved to OS keychain
briefroom login --token <pat> # CI use: save PAT directly, skip browser
briefroom whoami # Show current user (or --json)
briefroom logout # Remove PAT from keychain (does NOT revoke server-side)
briefroom deploy [dir] # Zip a directory and upload it, returns a share URL (default dir: .)
briefroom list # List your rooms (--json, --limit, --archived)
briefroom revoke <share_id> # Immediately revoke a share URL
briefroom feedback pull <share_id> --format prompt # Pull comments as LLM-ready Markdown
deployZips a directory (excluding .git / node_modules / .env* / keys) and uploads it. On the
first deploy it writes briefroom.json so subsequent deploys target the same room and keep the
same share URL.
briefroom deploy ./ # deploy the current directory
briefroom deploy ./ --new # force a brand-new room
briefroom deploy ./ --room my-proposal # target a specific room slug
briefroom deploy ./ --name '企画書 v2' # room display name (any language)
briefroom deploy ./ --expires 7d # expiry: 7d (default) | 30d | never
briefroom deploy ./ --password 's3cret' # password-protect the link (Pro+ plans)
briefroom deploy ./ --visibility unlisted # remove an existing password (unlist the link)
briefroom deploy ./ --no-password # same as --visibility unlisted
briefroom deploy ./ --private # private room: only you, signed in, can open it
briefroom deploy ./ --json # print the result as a single JSON line
--expires / --password / --visibility are applied to the existing
share link (same URL). Flags you omit are left unchanged, so a plain briefroom deploy ./ never
resets a "never" expiry or an existing password.--name sets the room display name shown on the dashboard and in the viewer (1-100 chars,
any language including Japanese). It is not the same thing as --room: the room slug is an ascii
identifier used only to decide which existing room to redeploy into, and it never appears in the
share URL (that always ends in an auto-issued random token). Without --name, the first deploy
falls back to the slug and a redeploy keeps the current name, so a room you renamed on the
dashboard is never silently overwritten by a local value.--private makes the room private: the share URL only opens for you while you are signed in
to briefroom, so an AI agent can keep overwriting the same URL without it being readable by anyone
who has the link. It is available on every plan, does not count toward the shared-room limit,
and can be combined with --expires never. It is shorthand for --visibility email_invite_only;
adding invitees later (from the dashboard) turns it back into a normal invite-only share.--password requires a Pro+ plan (Free returns an error). It also reads the
BRIEFROOM_SHARE_PASSWORD environment variable, which is preferred over --password because it
keeps the secret out of the process list (ps). Passing a password together with --no-password
or --visibility unlisted is rejected.BRIEFROOM_API_URL env or --api-url flag — default https://briefroom.netBRIEFROOM_TOKEN env — PAT used for auth (falls back to the OS keychain from briefroom login)BRIEFROOM_SHARE_PASSWORD env — password for deploy when you don't want it in argvMIT
FAQs
briefroom command-line interface — share AI-generated HTML, get feedback, loop back to your agent.
The npm package @briefroom/cli receives a total of 30 weekly downloads. As such, @briefroom/cli popularity was classified as not popular.
We found that @briefroom/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.