Aispace Opens an Agent File Drop Outside Chat

aispace-client is an open-source CLI that lets AI agents upload files and print an expiring share URL last. The hosted drop runs at aispace.sh, and the same GitHub repo ships a Codex skill, streaming uploads, and optional local age encryption.

GitHub listed 78 commits and 3 stars on the MIT-licensed repo, which holds the client, the agent skill, and examples, not the server, billing, or customer data. The open-source CLI and agent skill is the part you can inspect.

Chat Is a Bad Place for Agent Files

Coding agents now write reports, zips, images, and JSON that do not belong in a transcript. Chat logs keep those bytes for as long as the vendor keeps the thread. Tool-call traces copy the same payload into a second system.

A person can pause on a weird download URL. An unattended agent will fetch it at 3 a.m. and keep going. That is the hole a file drop for bots is trying to fill.

FOUR WAYS AGENTS DUMP FILES

• Presigned URLs: A cloud link dropped into a tool call also lands in model logs and trace exporters.
• Public buckets: A long random path still sits on a listing that scrapers already know how to walk.
• Base64 in chat: The file becomes part of the conversation, so its life follows the chat vendor’s retention window.
• Shared disks: One mount is simple until one compromised agent can read every file on it.

Those paths were built for people who can hesitate. AgentDrop, which sells encrypted agent-to-agent transfers, puts the same gap in plainer words.

An agent that decides on its own when to fetch a file at 3am has no UI. No confirmation dialog. No instinct that says “this URL pattern looks weird.”

AgentDrop, encryption documentation

aispace is aimed at a slightly different job: an agent (or a person) needs to park a temporary artifact and hand back a URL, a file id, or ciphertext, then get out of the way.

The URL Lands on the Last Line

The client is one binary. Uploads stream from disk. Stdin works. Automated flows are not supposed to hit an interactive prompt. With --json, a successful public handoff looks like this:

{"file":{"id":"...","name":"report.pdf"},"link":{"url":"https://aispace.sh/d/...","expires_at":1757003600}}

The share URL is also printed last on its own line, so a script can take the final line and ignore the rest. Errors go to stderr. With JSON, the error is an object that still includes code, message, status, and exit_code.

Install paths are ordinary for a Go CLI: curl -fsSL https://aispace.sh/install.sh | sh on macOS and Linux, npm install -g @aispace-sh/cli, Homebrew tap aispace-sh/tap/aispace, or go install github.com/aispace-sh/aispace-client@latest. Release binaries cover macOS, Linux, and Windows on amd64 and arm64. The shell installer does not cover Windows; npm does. Pinning uses AISPACE_VERSION.

A key from the aispace dashboard logs you in (aispace login --key ask_...). After that, aispace upload report.pdf --json stores the file. On Pro, --link --link-expires 1h --max-downloads 1 adds a public URL that can die after one download. Flags such as --expires and --max-downloads are listed in the aispace command documentation.

HOW THE CLIENT FAILS

Config precedence is flag, then environment, then ~/.config/aispace/config.json (mode 0600), then defaults. The default server URL is https://aispace.sh. AISPACE_AGE_IDENTITY can supply a decryption identity, and it is deliberately not accepted as a command-line flag.

Who Can Download, and for How Long?

Visibility and public links are separate. A file can be private to the uploading key, or shared with every active key on the account. A public URL is an extra capability. Creating one requires a Pro account, and it makes that one file available to anyone who holds the link.

Defaults are short. Omit --expires and the server uses 7 days for files. Omit --link-expires and it uses 1 hour for links. Durations take Go syntax plus a d suffix: 30m, 24h, 7d, 1d12h, or a bare number of seconds. Syntax examples in the README include 30s, 15m, 1h, 36h, and 7d.

FILE MODES ON AISPACE

A file dies when its lifetime ends. A link can die sooner if it expires, is revoked, or hits its download cap. Deleting the file cuts off key access and every public link on it. Monthly download caps still apply at the account level even when no public URL exists.

That Pro gate is the commercial split. Free users can store private or account-scoped files for up to 7 days. The bot-friendly public handoff, the thing an agent would paste back to a human, sits on paid.

Local Age Encryption, Remote Ciphertext

Optional encryption is local. aispace upload secret.pdf --encrypt --identity-out secret.agekey --link encrypts on the machine, stores ciphertext as secret.pdf.age, and keeps the generated age identity out of the API. Encrypted JSON responses add an encryption object. Plaintext exposure then needs both the ciphertext and the identity file.

The crypto is not a house format. Encrypted uploads follow the age v1 X25519 file format on the local machine. Recipients can be passed with --recipient. Downloads can check a recorded SHA-256 with --verify.

The identity handling is stricter than the rest of the CLI. You can point at a key file, or set AISPACE_AGE_IDENTITY, but you cannot paste the secret on the command line where process lists and shell history would keep it. Treat that file like a credential. The bundled Codex skill is written to do the same.

This is still not end-to-end by default. Skip --encrypt and the hosted service sees the bytes. The README is explicit that the server is a separate operation. Age is an extra switch for the cases where the operator of aispace.sh should only ever hold ciphertext.

Give Codex the Aispace Skill

The distribution bet is not a dashboard. It is a skill folder you symlink into Codex.

Clone the repo, make ~/.codex/skills, and link skills/aispace there. Restart Codex and tell it to use aispace when it needs to hand you a report, archive, image, or other generated file. The skill defaults to account-private storage unless you ask for a public link, prefers short expirations, and treats encryption identities as credentials.

OpenAI’s Codex agent skills format is a directory with a SKILL.md file that must include name and description. Codex starts with those fields and the path, then loads the full instructions only when it decides to use the skill. Skills run in the Codex CLI, the IDE extension, and the Codex app. For other runtimes, docs/LLM_USAGE.md in the aispace repo adds a system-prompt snippet, OpenAI/Anthropic-compatible tool schemas, and a reference Python handler.

The README also points Grok users at an aispace bot on Grok. That is the same idea in a different shell: give the agent a file tool instead of asking it to paste bytes into chat. Examples in the repo cover shell, CI, and encrypted handoff recipes.

None of that makes the hosted store open source. It makes the client easy to call from the places agents already live.

Why Not Just Use Magic Wormhole?

The first fair objection is that file transfer is a solved problem. Magic Wormhole (and Go ports such as wormhole-william) already moves a file with a short code, end-to-end encryption, and a relay you can host yourself. For two humans on a call, a wormhole code is enough.

An agent is a worse user. It needs a stable exit code, JSON on a known fd, no TTY prompt, a revoke command, a download cap, and a URL it can put in a ticket. Wormhole’s pairing code is a feature for people. It is friction for a cron job. aispace is betting that the unattended case is a product, not a wrapper around a human protocol.

It is not the only bet. AgentDrop sells identity, pairing, and client-side X25519 plus AES-256-GCM for agent-to-agent (and agent-to-human) transfers, with a free tier of 50 transfers and 50 MB files and a Scale cap of 10 GB. That product is about addressable agents. aispace is about a scriptable drop with expiry. Same hole in the stack, different door.

THREE FILE DROPS, THREE JOBS

Public chatter on the aispace client is still thin. The interesting part is not the star count. It is that two separate tools now describe chat, presigned URLs, and base64 blobs as the wrong pipe for agent output, and both answer with expiry plus client-side crypto.

Public links still need a Pro account, the age identity still stays in a local file, and the server that stores the bytes is still absent from the GitHub repo.