# ScreenRig full agent context > ScreenRig is an agent-operated digital-signage service: an agent uses the CLI and REST API to upload content, assemble a looping playlist, pair a browser screen, and observe the result. Last-reviewed: 2026-08-14. Phase: prerelease localhost v1. OpenAPI: 0.2.0. Skill: 0.2.0. This is curated direct-ingestion context, not a generated dump. llms.txt is a convention/proposal and does not control crawling or guarantee ranking. See https://screenrig.ai/robots.txt for crawl policy. ## Source priority 1. https://screenrig.ai/docs/api/openapi.yaml for HTTP schema and security schemes. 2. `screenrig --help` from the source checkout for current CLI commands. 3. `GET /api/v1/capabilities`, `GET /.version`, and https://screenrig.ai/status/status.json for runtime/version/readiness facts. 4. Repository architecture for intended invariants. 5. Human and Markdown site prose for explanation. ## Phase and evidence The full account, application/media publication, playlist, pairing, screen assignment, protected playback, K/V, operation/event, SSE resume, and three-backend routing lifecycle passed localhost acceptance. Black-box E2E recorded 118 pass, 0 fail, 0 blocked, and 10 deferred. The public ScreenRig marketing and documentation site is live and verified over HTTPS. The service API, Player, release hosts, protected content delivery, and full production application stack remain undeployed and unverified; npm packages remain unpublished. This is not an uptime, SLA, customer, or traffic claim. Android `standard`, `managed`, and `amazon` source flavors, the hardened full-viewport container, exact-origin Player bridge, and manifest-authorized native content cache are implemented. Unit tests, lint, debug APKs, R8 release APKs, and Player unit/browser integration pass. Android instrumentation was compiled but not run because this host has no KVM. No personal Pixel, managed physical device, or Amazon Signage Stick was validated; no app is store-published. The native cache improves resilience but is not a general offline-playback guarantee. ## Verified quickstart ```sh npm --prefix packages/sdk ci npm --prefix packages/sdk run build npm --prefix packages/cli ci npm --prefix packages/cli run sync:sdk npm --prefix packages/cli run build make local-up make smoke screenrig() { node packages/cli/dist/bin.js "$@"; } screenrig --api-url http://api.screenrig.localhost:8088 \ account create --email agent-owner@example.com --json screenrig auth status --json # Open http://play.screenrig.localhost:8088 first. screenrig screen pair --code ABCDEF --label "Lobby" --json screenrig app upload ./path/to/built-webapp --json screenrig playlist create ./playlist.json --json screenrig screen assign scr_example --playlist-id pl_example --if-match 1 --json screenrig events follow --json ``` Expected success: account and auth checks succeed; pairing returns a screen; application upload waits for publication; playlist creation and assignment return revisioned resources; event follow emits durable cursor-bearing events. Placeholder codes and IDs are not live values. Account creation stores its credential with mode 0600 and prints only a lookup identifier. ## Command families - `account create --email ADDRESS`, `account show`, `auth status` - `app pack DIRECTORY`, `app upload DIRECTORY`, `app list`, `app show ID` - `media upload|list|show|delete` - `playlist create|update|show|list|delete` - `screen pair`, `screen list|show|update|assign|delete`, credential/public-ID rotation - `kv get|set|delete|list --application-id ID` - `operations get|wait|cancel ID` - `events list|follow [--after CURSOR]` - `doctor [--repair-config]`, `version` Use `screenrig --help` for exact current syntax. Do not install an unrelated public npm package named `screenrig`. ## HTTP semantics Account control uses `accountBearer` only on account API routes. Player pairing/device/runtime cookies, placement capability, release launch ticket/grant cookie, and operator bearer are distinct realms. Never move credentials between origins or realms. Authenticated mutations use `Idempotency-Key`. Retry an ambiguous mutation with the same key and identical request. Reusing a key for a different request returns `409 idempotency_mismatch`. Mutable resources carry integer revisions and ETags. Changes require `If-Match`; stale writes return `412 revision_conflict` with current revision and corrective context. Application uploads may begin in `receiving`; long work then uses `queued`, `running`, `succeeded`, `failed`, or `cancelled`. Events are durable before fan-out. SSE cursors are opaque; resume with the last cursor or `Last-Event-ID`. On `stream.resync_required`, refetch authoritative state and resume at the supplied head cursor. Errors use `application/problem+json` in the RFC 9457 shape. Branch on `status` and stable `code`, not human `detail`. See https://screenrig.ai/docs/api/problems.yaml. ## Content and playback An application upload is a deterministic compressed archive of already-built static content. The server validates and extracts it in a sandboxed boundary; it does not build or execute uploaded source. Successful publication produces immutable release identity. A playlist pins immutable application releases and media. A fresh Player displays a six-character code. An authenticated agent claims it, then assigns a playlist with the current screen revision. The Player converges through complete manifests, SSE invalidation, and polling fallback. A failed desired manifest does not blank a last-known-good active manifest. ## Trust boundary Account bearer tokens belong only on the account API origin and never enter URLs, Player code, uploaded frames, logs, or events. Player credentials stay on the trusted Player origin. Each uploaded application runs in a sandboxed iframe on an isolated per-release origin and gets only placement-scoped capability. Protected release, media, and K/V delivery is authorized transitively through current desired or active screen-manifest grants. Knowledge of an upload, release ID, media ID, object key, or filesystem path does not authorize a read. There is no arbitrary object listing or public download route. ScreenRig is not public file hosting. Public screen URLs are unlisted read-only playback, not confidential. An authorized viewer can inspect bytes delivered to the browser. Never put secrets in screen-visible content or K/V. ## Architecture MongoDB is authoritative for accounts, content metadata, playlists, screens, K/V indexes, operations, and durable events. Valkey coordinates short-lived pairing, rate limits, leases, and cross-instance wake-ups; it is never the only copy of durable customer state. Three interchangeable Go replicas sit behind the edge. Private object/release storage is not a public origin. ## Limits The server publishes the authoritative capability document. Intended design limits include 50 screens and 1 GiB retained uploads per account; 100 MiB compressed and 250 MiB expanded application archives; 5,000 files; 32 MiB per app file; 100 playlist pages; 24 placements per page; and 1 MiB per K/V value. These are not pricing or a commercial offer. Billing is absent from v1. ## Observation and repair Use manifests, reports, operation state, and durable events. Screenshot capture is not v1. Run `screenrig doctor --json`; use `doctor --repair-config` only to repair configuration permissions. On revision conflict refetch. On SSE resync refetch authoritative state. Redact authorization, cookies, signed URLs/headers, object keys, and customer content from logs. ## Deferred and evidence-gated boundaries MCP, billing/x402/Stripe, screenshot capture, email recovery, and a management dashboard are deferred. Android physical/instrumentation/store validation and a general offline-playback guarantee remain gated. Do not infer hardware behavior or public availability from source/build evidence. ## Discovery - https://screenrig.ai/index.md — concise product and quickstart. - https://screenrig.ai/docs.md — operator docs. - https://screenrig.ai/docs/api.md — generated API guide and endpoint inventory. - https://screenrig.ai/docs/api/openapi.yaml — authoritative OpenAPI YAML. - https://screenrig.ai/docs/api/openapi.json — equivalent OpenAPI JSON. - https://screenrig.ai/docs/api/problems.yaml — problem registry. - https://screenrig.ai/skill/SKILL.md — downloadable agent skill. - https://screenrig.ai/skill.md — skill overview as Markdown. - https://screenrig.ai/status.md — implementation readiness. - https://screenrig.ai/docs/llms.txt — docs-specific index. - https://screenrig.ai/sitemap.md — public content map.