feat(uploads): 'panda upload' — private preview, publish on click

[qu0b]

TL;DR

panda upload <file> gives you a private, in-browser preview of a file. Click Make public (or pass --public) to promote it to R2 and get a durable link. Private previews never leave your machine — publishing is always a deliberate choice.

The flow

$ panda upload report.html
http://localhost:2480/u/6f1c…      # private preview opens in your browser
private preview (session-only) — click "Make public" to publish

The preview page renders the file and shows a Make public button → durable link:

https://data.ethpandaops.io/panda/uploads/9f3ca1/report.html   (expires in 60 days)

Other forms: --public skips the preview and prints the URL (scripts/CI); - reads stdin (with --name); --no-open won't launch a browser.

How it works

Bytes flow CLI → local server → proxy → R2, and that split is what keeps it safe:

Stage	Where it lives	Notes
Private preview	local server, in memory	session-only; bounded store, evicted oldest-first; nothing on disk, nothing remote
Publish	proxy /uploads route	the proxy holds the R2 credentials; the server only forwards the stored bytes + caller attribution
Public object	shared -public R2 bucket, panda/uploads/ prefix	content-addressed panda/uploads/<sha6>/<name>; served at data.ethpandaops.io; 60-day lifecycle

No new MCP tool — the 3-tool contract is untouched.

Files

• pkg/cli/upload.go — the upload command (--public, --no-open, stdin).
• pkg/server/uploads.go — in-memory store + POST /api/v1/uploads, preview page GET /u/{id}, raw GET /u/{id}/raw, POST /api/v1/uploads/publish.
• pkg/proxy/handlers/uploads.go (+ /uploads route, uploads: config) — the credentialed R2 PutObject.

Safety

• Publishing is authenticated + rate-limited — org-gated at token issuance, plus a dedicated per-user limiter (60/min, burst 20) on top of the generic one.
• Size cap — 100 MiB on both the in-memory buffer and the R2 write.
• Filename sanitization — path stripped, restricted to [A-Za-z0-9._-], length-capped.
• No inline scripts from the public bucket — html/svg/js get Content-Disposition: attachment.
• Safe preview — raw bytes served with a sandbox CSP + sandboxed <iframe>, so previewing a malicious HTML upload can't run scripts in the local server's origin.

To go live

Needs the companion ethpandaops/platform#365 (R2 writer key, the uploads: proxy config, the 60-day panda/uploads/ lifecycle) plus a proxy image bump once this merges. Until then the route is simply absent.

Tests

go build ./..., go vet, gofmt, and the pre-commit golangci-lint all pass clean. New unit tests cover the proxy handler (filename sanitization, inline-safe classification, guards) and the server (store eviction, upload/publish handlers, sandbox CSP). Existing pkg/proxy / pkg/server / pkg/storage / pkg/cli suites pass.

Design notes: docs/proposals/assets-cli.md.

[github-actions]

🐼 Smoke eval — e9ea050: ✅ 8/8 pass

📊 Interactive report — tokens p50 15,254 · tokens/solve 18,942.

Reference points: qu0b/panda-assets-cli@11dd1f4 100% · qu0b/panda-assets-cli@bc0bfb9 100% · qu0b/panda-assets-cli@e6c1b3c 100%.

question	result	tokens	tools
forky_node_coverage	✅	14,997	4
tracoor_node_coverage	✅	13,662	4
mainnet_block_arrival_p50	✅	15,651	7
list_datasources	✅	12,809	2
block_count_24h	✅	15,512	7
missed_slots_24h	✅	14,871	6
chartkit_default_arrival_distribution	✅	43,749	14
storage_upload_session_scoped	✅	20,283	16

🔭 Langfuse traces (8 runs; ⚠️ = failed)

• forky_node_coverage
• tracoor_node_coverage
• mainnet_block_arrival_p50
• list_datasources
• block_count_24h
• missed_slots_24h
• chartkit_default_arrival_distribution
• storage_upload_session_scoped

_{The report walks this branch's commits against the master baseline and the most recent release. A self-contained copy is in the run's eval-smoke-* artifact.}