Columbia Pages

A small self-hosted service that lets agents publish polished HTML reports and return a shareable public URL.

Overview

Columbia Pages combines a Go server, SQLite, a command-line client, an embedded report theme, and an agent skill. Agents send body-only HTML through an authenticated API; the service stores it, applies the house theme, and serves it at an unguessable public URL.

Built for useful artifacts

Reports, comparisons, tables, analyses, and status summaries become durable pages instead of oversized chat messages.

Runtime
Go
Single service
Storage
SQLite
One persistent volume
Authentication
Device
Scoped and revocable
License
MIT
Self-host friendly

Feature set

Core capabilities
AreaWhat it provides
PublishingThemed body HTML or complete raw documents, plus create, list, get, update, delete, slugs, and optional expiry.
Agent workflowA repository skill, stdin-first CLI commands, structured JSON reads, and an agent-oriented setup guide.
PresentationResponsive typography, navigation, stats, tables, callouts, facts, code blocks, light/dark mode, and print support.
AuthenticationBrowser-approved device login with read or read/write scopes, finite token lifetimes, revocation, and logout.
AdministrationOwner login, device review, token inventory, and token revocation on a dedicated control origin.
OperationsRailway-first self-hosting, SQLite persistence, health checks, expiry sweeps, backups guidance, and graceful shutdown.

How it works

An agent publishes through the private control plane. Readers only touch the public content origin.

Columbia Pages publishing flow An agent sends HTML through the CLI to the authenticated control API, which stores it in SQLite. A browser then reads the themed public page from a separate content origin. Agent body HTML cpages CLI device token Control API scoped write SQLite page + metadata Public page theme + unguessable ID Reader browser public URL Authenticated publishing above; public reading below
One service and one database, exposed through two deliberately separate origins.

Repository signals

Measured from the current repository checkout.

Current repository counts The repository contains 5 Go packages, 8 CLI commands, and 36 test functions. Go packages 5 CLI commands 8 Test functions 36 Count of current packages, user-facing commands, and Go test functions
A compact codebase with a deliberately broad verification surface.
Accessible chart data
SignalCount
Go packages5
CLI commands8
Test functions36

Security model

Published HTML is active content, so Columbia Pages separates authoring authority from public viewing at the origin boundary.

Control and public origin boundaries The control origin contains owner login, device approval, token administration, and the page API. The public origin contains only public pages and the theme. Requests to the wrong origin return HTTP 421. Control origin Owner login and sessions Device approval and denial Scoped JSON API Token inventory and revocation Private authority surface Public origin Ungues­sable page URLs Embedded house theme Themed or raw HTML No API tokens or admin cookies Shareable content surface 421 Wrong-origin and unknown-host requests are rejected
The separation keeps active published HTML away from browser credentials and management tokens.
  • Device grants expire after 10 minutes and are single-use.
  • Device tokens default to 90 days and can be scoped, listed, and revoked.
  • The database stores hashes rather than raw device and API secrets.
  • Admin forms use host-only cookies, CSRF protection, origin checks, and rate limits.