The build archive for chats whose code can download nothing, and privacy first

Merged
AL
1d ago
+146-32

Closes #47.

It pins h5p-author 0.9.8, published on 2026-11-13. That release's one-file tool prints its versions (missing-elements/h5p-offline-player#199), and its skill points at this archive (missing-elements/h5p-offline-player#201). The site's build now runs the tool's --version and stops unless it prints the pinned author and pack versions.

The archive

bundles() now also writes /h5p/bundles/h5p-author-build.tar.gz. It holds the one-file tool, every part of the pack with its index, and libraries.txt, laid out the way a build from a bundle reads them:

tar -xzf h5p-author-build.tar.gz
node h5p-author.mjs build source.json course.h5p --libraries parts
  • Size: 14,880,762 bytes with author 0.9.8 and pack 1.1.0. index.json lists it under archive with its size.
  • Format: a gzipped ustar archive written by a small tarGz(), since Node has gzip but no tar. Every date is fixed, there is no owner, and the gzip header's OS byte is fixed. A second build wrote the same bytes.
  • Read back: bsdtar and Python's tarfile unpack it to the same files. A Question Set built from it fresh passes the verifier.
  • Why .tar.gz: ChatGPT refused the same files as a .zip, reading it as a plugin to install.

Pages

The guide, /h5p/create-with-ai/:

  • The ChatGPT install item says to download the archive once and attach it where you ask: ChatGPT then builds the file in the chat, and without it hands over the link.
  • Step 4 opens with "The build tool is a Node.js program", and says ChatGPT builds the file with the archive attached.
  • A new section, With a local model, or offline:
    • Chat apps for local models don't run Node.js out of the box: Open WebUI's code tool runs Python, LM Studio's code plugin runs JavaScript in Deno, and Jan has no code tool of its own. So they hand over the link or the source.
    • Open WebUI with Open Terminal is the exception: its default image has Node.js.
    • With Node.js on your own computer, an agent with a terminal and a local model builds offline from the archive.
  • A new help entry, "The chat says it cannot get the build tool", which points to the archive.
  • The privacy paragraph now reads "Privacy first: nothing you make is sent to this site, and there is no MCP server or other server of ours in between …". It still says the AI chat sees what you send it.

The build page, /h5p/build/:

  • The title is "Free AI H5P generator, privacy first: make H5P with ChatGPT, Claude or Grok".
  • The description ends "Free, privacy first: no MCP server, no account."
  • The "Built in your browser" card becomes "Privacy first, no MCP server".
  • Step 3 of "How it works" says ChatGPT builds the file with the build archive attached.

The ChatGPT plugin's plugin.json:

  • The description leads with "Privacy first, no MCP server".
  • The shortDescription is "H5P activities from a prompt: privacy first, no MCP server" (58 characters).

README: the /h5p/bundles/ row and the paragraph on how a chat builds.

Checks

A local build on 0.9.8, served with vite preview, passes 80 page checks in Chromium at 1280 and 390 px. They are the 66 from #42, with the ChatGPT item's three download links, plus checks for:

  • the new section, the help entry and step 4's sentences;
  • the privacy wording on the guide and the build page;
  • the build page's title;
  • the archive answering 200.

The local-model facts come from the apps' own documentation, read on 2026-11-13:

  • Open WebUI's code execution page: Pyodide and Jupyter run Python; Open Terminal gives full shell access.
  • Open Terminal's docs: its default image lists Node.js and npm.
  • LM Studio's js-code-sandbox plugin: it runs JavaScript or TypeScript in Deno.
  • Jan's docs: code runs only through MCP servers.

None of these apps has been tried with the skill.

Summary by cubic

Closes #47. Pins @missing-elements/h5p-author to 0.9.8, whose one-file tool prints its versions, and writes /h5p/bundles/h5p-author-build.tar.gz: the tool, every library and libraries.txt, laid out so tar -xzf and --libraries parts work, with identical bytes on every build. A chat whose code runs Node.js but downloads nothing, like ChatGPT's, builds the .h5p from the archive when the person attaches it; the site's build runs the tool's --version and stops unless it prints the pinned author and pack versions.

  • The guide and build page say to download the archive once and attach it; ChatGPT builds the .h5p in the chat, or hands over a link without it.
  • The guide says the tool needs Node.js 22 or later, covers local-model chat apps (they don't run Node.js), and building fully offline with a terminal agent.
  • The build page, guide privacy paragraph, and ChatGPT plugin lead with "privacy first, no MCP server".