Workspaces

A workspace is a team home for artifacts. Publishing and reviewing don't change: every artifact still has its own review link, and unless you give it workspace or private visibility, guests open it with no account. A workspace adds shared ownership on top — a place where a team's artifacts are collected under one handle, organized into folders, and given a visibility that decides who can open them.

This page describes the model. Some of it is live today; the rest is designed and rolling out. The Available now / Rolling out list at the end says which is which, so nothing here is a step you can't yet take.

Members and roles

A workspace has members, each with a role:

• Owner — full control, including deleting the workspace.
• Admin — manage members, invites, and folders.
• Member — publish and review inside the workspace.

You create a workspace from the dashboard with a name and a handle. The handle is your workspace's address at /w/{handle} — and, once you enable the subdomain (a one-time opt-in offered when you create the workspace or later in Team settings), also at {handle}.artifact.cafe, so choosing the handle is choosing the subdomain. It's proposed from your team name and you can edit it: 3–32 lowercase letters, digits, and hyphens, and the form tells you as you type whether it's available, already taken, or a reserved word we keep for our own routes. Pick it carefully: changing it later breaks shared links, and a released handle is held for 30 days before anyone else can claim it. When you create a team workspace you can invite teammates by email right away, and admins can invite more anytime with an invite link or an email invite — each carries a role and can have an expiry and a maximum number of uses. Invite tokens are returned once and stored hashed, like claim and publish tokens. Joining a workspace requires signing in, because a member acts under a real identity.

Guest commenting is unchanged: anyone who can open a review link comments without an account, unless the author has closed review on that artifact (see Reviewing). Signed-in members are recognized and comment under their account name; outside reviewers still use the guest-name flow.

Your personal workspace

Every account comes with a personal workspace, created automatically at sign-up. It's where your own artifacts live: publishing with an API key and no explicit or project-default workspace lands there, and claiming an anonymous artifact moves it there. It works like any workspace — folders, visibility, a /w/{handle} page, a rename-able handle — except it's strictly yours: no invites or members, and it can't be deleted. On a personal workspace, workspace visibility simply means "only you".

From an artifact's Manage panel in Personal, choose Move to workspace to transfer it to a team you belong to, optionally placing it in one of that workspace's folders. The team becomes the owner; the review link, immutable versions, and comments stay in place.

Folders

Folders organize a workspace's artifacts. A folder is either public (anyone can see the artifacts in it) or workspace (only members can). A folder also supplies a default visibility for the artifacts placed in it, so you sort once instead of setting each artifact by hand. Moving something into a public folder therefore publishes it, and the dashboard asks you to confirm that before it happens. Public folders are shareable: each has a permalink at {handle}.artifact.cafe/f/{folder}, listing its public artifacts — the dashboard shows the link (with a copy button) whenever you're viewing a public folder. Renaming a folder changes that link. Artifacts move between folders from the row's move menu or the manage panel — or from the CLI with artifact-cafe move --folder <name>.

Your agent can do the filing for you. Organizing artifacts covers the skill's tidy-up flow, choosing a folder at publish time, and what a placement does to an artifact's visibility.

Artifact visibility

Every artifact has a visibility that controls who can open it:

• public — anyone with the link, and listable in a workspace's public views. This is the only visibility search engines may index: a public artifact with no password appears in artifact.cafe's sitemap and its review page invites crawlers.
• unlisted — link-only. The slug is random and unguessable; this is how an unclaimed artifact behaves today. Never indexed — the review page carries noindex, so an unlisted link that leaks still won't surface in search.
• workspace — members only. Anyone who isn't a member of the artifact's workspace is asked to sign in. This is enforced on both origins: the review shell and the isolated {slug}.artifactcafe.dev render origin (an agent reading over the API gets 401 workspace_required and must retry with a member API key).
• private — invited people only. No one sees it except the workspace's owners and admins, whoever published it, and the specific people you share it with by name (below). A plain member without a share can't open it or see it listed. On a personal workspace this reads as "only you and invited people". Enforced on both origins, same as workspace.

Visibility is the general-access dial; sharing with specific people layers named access on top. From an artifact's Share panel (or artifact-cafe share alice@corp.com) you invite someone by email or existing account — they get an invitation link that opens the artifact under their own name — the link proves the address, so someone without an account picks a name and avatar and lands straight on it, with no code to type. Invited people are "viewers": they can't manage the artifact or share it onward. Grants bite only where visibility gates viewing (workspace, private); on a public/unlisted artifact reviewers still never need an account. Revoke access any time from the same panel (or artifact-cafe unshare alice@corp.com).

Visibility and password protection are independent gates — an artifact can be public and still sit behind a shared password, or workspace with no password.

Available now / Rolling out

Available now:

• Create a workspace and get its handle.
• A personal workspace for every account — your own artifacts, folders included, with no setup.
• Invite teammates by link or email, with roles (owner / admin / member).
• Rename or delete a workspace.
• Organize artifacts into folders and change visibility from the dashboard.
• Publish straight into a workspace and folder from the CLI (publish --workspace --folder); later bare publishes stay in that placement.
• Pick a destination on a human CLI, or commit artifact-cafe.json so agents and fresh checkouts publish new artifacts to the intended workspace without guessing.
• Move a personal artifact into a team workspace from its dashboard Manage panel.
• Set an artifact to private and share it with specific people by email or account, from the CLI (artifact-cafe share / unshare) or the API. Works on personal workspaces too.
• List memberships from the CLI with artifact-cafe workspaces --json.
• Discover folder names and visibility with artifact-cafe folders --workspace <handle> --json.
• Create folders (artifact-cafe folders create <name>), re-file artifacts without republishing (artifact-cafe move --folder <name>), and list a workspace's artifacts grouped by folder (artifact-cafe list --workspace <handle>) — so agents can keep the library organized from the CLI.
• Your workspace's public gallery, served at {handle}.artifact.cafe (and /w/{handle}): public folders and public artifacts, no account needed. Members opening it land in the workspace dashboard.
• Members commenting under their own name in review — signed-in members are recognized automatically, while outside reviewers still use the guest-name flow.

Rolling out:

• The workspace model above is now live end to end; new capabilities will be listed here as they arrive.

An artifact's home is still its own review link, and a workspace is where your team and its shared settings live. See Publishing concepts for how artifacts and versions work, and Tokens and auth for accounts and the dashboard.