Let artifacts read their own uploaded files, so they can export images and video
Adelina Djeneva
Artifacts can show the photos, videos and audio uploaded with them, but they can't read them. ClickUp serves these files without read permission for the artifact's sandboxed frame. So anything an artifact draws from them is locked by the browser: canvas toBlob and captureStream refuse, and the artifact can't export a PNG or record an MP4 that uses its own files. Downloads themselves work. Only reading is blocked.
Our case: we built our ad template tool as an artifact. Brand photos, video clips, music and logos come with it as files, get layered into ads at each platform's sizes, and are exported as PNG and MP4. Inside ClickUp, every export that uses a library photo or video is blocked. The only way round it is building the files into the artifact's code, but the 20 MB limit makes that impossible for a real asset library (ours is about 90 MB).
Either of these would fix it:
- Serve an artifact's own uploaded files with CORS headers that allow its frame, so images and videos loaded with crossOrigin="anonymous" can be read.
- Or a host bridge call that hands the artifact the bytes of one of its own files.
The sandbox stays closed to outside networks. The artifact only reads files it was saved with.
Log In