sher

Why it's ranked here

The case rests on narrow scope done cleanly. The whole client is a handful of short TypeScript files with no runtime dependencies, the server that hosts the links ships in the same repository under AGPL-3.0, and self-hosting is a documented four-step Cloudflare setup. It also ships an agent skill that tells a coding agent how to run it and pull the link out of the output, which is why it shows up in AI tooling lists. Against that, the project labels itself beta and the free tier allows a single link per day.

What's good

Next.js projects get special handling: sher temporarily switches the config to static export, patches pages that need to be forced static, builds, then restores the original files even when the build fails. Limits are enforced on the server, not trusted from the client: file size, file count (1,000 maximum), link lifetime and password access are all checked per tier. Uploads without a root index page are rejected with a plain message. Anonymous use needs no account, and a GitHub login lifts the limits to 25 links a day with 24-hour lifetimes.

Tradeoffs

Your build output goes to a third-party host unless you self-host. The login token is saved as plain JSON in your home directory. Link passwords are hashed with a single SHA-256 pass salted by the link ID, which is fast to brute-force for short passwords. If the server cannot confirm a login token, the CLI falls back to trusting the username passed in the callback address. The whole build travels as one base64 JSON request, so large outputs hit the 10, 50 or 100 MB tier caps quickly. Password protection and week-long links need the paid Pro tier.

How to use it well

Use it for the moment you want a colleague, client or reviewer to click around a static build without setting up a hosting project: design reviews, demos, a quick check on a phone. Log in once with GitHub, since anonymous links cap at six hours and one per day. Point it at a prebuilt folder when detection guesses wrong. Give coding agents the bundled skill so they return a link after building. Look elsewhere for anything with server rendering or APIs, and self-host if build output must not leave your infrastructure.

Observed

License

AGPL-3.0 (declared in package.json and LICENSE)

Language

TypeScript, Node CLI plus a Cloudflare Worker backend

Install

npm package shersh, providing the sher binary (npm i -g shersh or npx shersh link)

Interface

CLI with link, list, delete, login, logout, whoami, upgrade and cancel commands

Runtime dependencies

None; package.json lists only devDependencies (tsup, typescript, @types/node)

Hosting backend

Cloudflare Workers with R2 storage and KV, self-hostable per README.md and worker/wrangler.toml

Framework detection

Vite, Next.js (static export), Astro, Create React App, or any dist/build/out folder (src/detect.ts)

Tier limits

Anonymous 1 link/day, 10 MB, 6 h; GitHub login 25/day, 50 MB, 24 h; Pro 200/day, 100 MB, 168 h (worker/src/index.ts)

Upload rules

Maximum 1,000 files; an index page at the root is required

Password storage

SHA-256 of password plus link ID, Pro tier only

Agent integration

Bundled agent skill at skills/sher-deploy/SKILL.md describing how to run it and parse the URL

Project status

README badge marks the project as beta