Artifact storage

Tasuku can publish deep-research results as private HTML artifacts instead of placing the full report in Slack. The Slack reply links to <public-url>/artifact/<artifact-id>. Tasuku authenticates the viewer, reads the stored object from R2, and streams the HTML through a same-origin Worker response into a sandboxed iframe.

There is nothing to configure to enable this: the ARTIFACTS R2 bucket (tasuku-artifacts) is provisioned automatically with every deployment, and artifacts are written there directly by the Worker. Bring-your-own S3-compatible storage — the per-organization TASUKU_ARTIFACT_S3_* configuration from the previous version — is removed; R2 is the only artifact store.

Isolation

The viewer response sets Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups allow-downloads. This gives the served HTML an opaque, unique origin distinct from Tasuku's own dashboard origin, even though both are served from the same hostname by default — the report can run scripts and submit forms inside itself, but it cannot navigate or script Tasuku's top-level page. See Security.

Set ARTIFACT_PUBLIC_BASE_URL (a wrangler.jsonc var, empty by default) to serve artifacts from a second hostname instead of the instance's own public URL, if you want an additional layer of origin separation beyond the CSP sandbox.

Visibility

Artifacts are private by default and require an authenticated viewer. A super user can mark an individual artifact public through its visibility setting; a public artifact is then served without authentication until visibility is toggled back.

Reports are single UTF-8 HTML documents capped at 512 KiB. When storage is unavailable or publication fails, Tasuku keeps the Markdown research result on the work item instead.

Local development

bun run dev runs against local R2 (via Miniflare) automatically — there is no separate object-storage service to start, unlike the previous MinIO-based development setup.