snappy-https

Handles URLs shared in chat that point to external resources - DigitalOcean Spaces objects, images, zips, or any HTTPS link. Prevents the failure mode where the user pastes a URL expecting the agent to fetch or inspect it, and the agent ignores the link entirely.

Observed user requests

These are the prompts that triggered this skill being scaffolded:

• "https://robert-storage.tor1.digitaloceanspaces.com/shared/2026-04-28-1777395923733-crayon-sdk.zip -- Okay, so I just now"
• "https://robert-storage.tor1.digitaloceanspaces.com/shared/2026-04-28-1777409614425-snappy-region-1777409610914.png -- sc"
• "https://robert-storage.tor1.digitaloceanspaces.com/shared/2026-04-29-1777436955168-snappy-region-1777436950892.png -- th"

Steps

• Detect the URL's content type via a HEAD request (curl -sI <url>) - check Content-Type response header.
• For image types (image/*): download to /tmp/snappy-fetch-<timestamp>.<ext> and display via state/lib/agent-browser.ts screenshot or pass to state/lib/image.ts for analysis.
• For archive types (application/zip, application/x-tar, etc.): download to /tmp/, extract with unzip -l or tar -tzf to preview contents without full extraction.
• For text/JSON types: curl -sL <url> and surface the first 200 lines.
• For DigitalOcean Spaces URLs (*.digitaloceanspaces.com): no auth required for public objects; private objects need DO Spaces credentials via env("DO_SPACES_KEY").
• Log the fetch result (url, content-type, byte-size, disposition) as an eval row via score("snappy-https", run_id, { score: 1.0 }).
• Never store fetched content in git or .env.cache - temp files under /tmp/ only.

Steps (scope-only / apply:false)

1. Scope - no side effects

What to read, what to compute, what to return. This step MUST be runnable with no apply: true flag and no credentials beyond read-only.

2. Gate

Hard-fail any missing required field. Never soft-skip. The gate is the protection against "I thought we checked that."

3. Act (only if the gate passes)

The real work. Dispatch, write, post, or compose. Keep this step thin - heavy logic belongs in state/lib/snappy-https.ts (or state/bin/snappy-https/), not inline here.

4. Log + eval

import { score } from "../../lib/eval";
score("snappy-https", run_id, {
  score: <pass = 1.0 | partial = 0.5 | fail = 0.0>,
  primary_issue: <null | one-line reason>,
});

Eval

Actor: the thing that produces the output (a dispatch model, a CLI, or the state/lib/snappy-https.ts library if one exists). Auditor: the thing that judges (must be different - see CONSTITUTION invariant #3). Name both explicitly.

Score convention:

If you cannot name a deterministic auditor, switch the frontmatter to eval: manual and log to state/log/pending-eval.ndjson - but fight to avoid manual. Manual is the escape hatch that leaks the thesis.

Gotchas

• List concrete failure modes you hit while building. Examples: "API

returns 200 with empty body"; "round-tripped text has a , artifact where em-dashes used to be"; "cache file is stale after 12h."

• If a gotcha matches an entry in user memory (see ~/.claude/CLAUDE.md),

cite the memory name so future agents can follow the trail.

snappy-https - loader

Per-turn rules for snappy-https. Full reference: state/skills/snappy-https/SKILL.md.

Critical Rules

1. Default scope-only (apply:false). Preview the download; require explicit confirmation before any write.
2. HEAD probe first. curl -sI <url> extracts Content-Type header. Route by type.
3. DO Spaces public (no auth by default). Private objects need env("DO_SPACES_KEY").
4. Never persist to git. Temp files /tmp/snappy-fetch-<timestamp>.<ext> only.
5. Eval row mandatory. After run: score("snappy-https", run_id, { score: 1.0 }).

Commands

| ui dashboard | state/skills/snappy-https/resources/ui.openui |

Self-Test

An agent reading this should correctly:

1. [ ] Detect content-type via HEAD before downloading?
2. [ ] Route image/zip/text by type?
3. [ ] Use DO Spaces public access without explicit auth?
4. [ ] Write eval row with score=1.0 on success?
5. [ ] Never commit temp files to git?
6. [ ] Pass DO Spaces URLs (*.digitaloceanspaces.com) as no-auth by default?

Self-correcting loader (PID feedback)

If this loader didn't cover your case - missing content type, no DO Spaces fallback, wrong temp path - you MUST attempt an Edit to this AGENTS.md before you log.

Log before exit:

echo "[$(date -u +%FT%TZ)] snappy-https: <what was missing or fixed> [FIXED|LOGGED] action_kind=skill-ran" >> state/log/loader-feedback.log

• FIXED = you edited this file inline.
• LOGGED = the fix was too large; it's queued for regen.

OpenUI Resource

• Skill-owned OpenUI Lang resource: state/skills/snappy-https/resources/ui.openui. Read it before rendering or editing this skill's generated component surface.
• Treat this resource as a first-class artifact of the skill, not a generic chat response. Improve it when the skill's user-facing output needs to become richer.
• System resources compose OpenUI primitives and inherit SnappyChat tokens. Use ui_contract: branded in SKILL.md only for deliberate platform or client visuals.