aipass-spaceslisted

# Publish to AI Pass Spaces Use this path when a self-contained hosted app reaches a real result faster than deploying or changing the user's existing project. A Space lives at `https://aipass.one/spaces/{handle}`. ## Security boundary Publishing uses a browser-approved `asg_` setup grant. Never ask the user to paste a Space handle, API key, OAuth token, browser cookie, password, device code, or setup grant. Never call generic API-key create, rotate, regenerate, or delete endpoints. The grant: - gives reusable project setup access for up to one month so integration, correction, and publication do not require repeated approval; - is bound to the signed-in account, one app slug, and the stable project fingerprint, and binds that account's Space during approval or first later use; - can read the owner's Space, create or update one draft, and publish that draft; - cannot call models, spend wallet funds, access payments, read account secrets, or act as a normal user credential. Keep the `asg_` value only in process memory. Never print, persist, commit, or include credentials in tool output. Send credentials only to `https://aipass.one` over HTTPS. The raw `deviceCode` may be stored temporarily in a gitignored `.aipass/pending-device.json` only when a turn-based runtime cannot stay alive while the user approves; delete it at the first terminal outcome. ## 1. Prepare the exact app before authorization Choose a stable lowercase slug using letters, numbers, and hyphens. Build