📋 tclip

Done! Here's what I built:

---

~/Personal/tclip/ — text clipping service

Endpoints

Route	Method	What it does
/	GET	Lists the last 50 clips (newest first)
/clip	GET	Shows a contenteditable paste form — paste rich text from browser/Word/anywhere
/clip	POST	Accepts form data (from the browser) or JSON (for API/skill use)
/<slug>	GET	View a single clip with its formatted body

API usage (for your skill)

curl -X POST http://your-server/clip \

-H "Content-Type: application/json" \

-d '{"title": "My Clip", "user": "beholder", "body": "<p>Rich <b>formatted</b> text</p>"}'

Returns: {"ok": true, "slug": "a3f2c", "url": "https://your.domain/a3f2c"}

Config (.env)

Variable	Default	Purpose
MAX_CLIP_SIZE	8192	Max body bytes before sanitization
BASE_URL	http://localhost:5000	External URL used in generated links (set to your nginx domain)
ALLOWED_POST_CIDR	127.0.0.1/32,192.168.0.0/16	CIDRs allowed to POST (comma-separated)
CLIPS_PER_PAGE	50	Clips shown on index
DEBUG	false	Flask debug mode

Storage

Each clip is two files under clips/: - clips/<slug>.html — sanitized HTML body - clips/<slug>.json — title, user, timestamp metadata

Running

cd ~/Personal/tclip

.venv/bin/python app.py # dev server on :5000

For production behind nginx, make sure you pass the real IP:

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

Design notes I think are worth mentioning

• Sanitization: Uses bleach with CSSSanitizer. Allowed tags cover common formatting (b, i, p, h1-h6, ul/ol/li, table, img, a href, blockquote, pre/code, etc.). Scripts, event handlers, and dangerous CSS are stripped. img src is allowed — if that's a concern, it's easy to remove.
• Slugs: 5 hex chars via secrets.token_hex(3)[:5] — ~1M namespace, collision probability is negligible for personal use.
• IP check: Respects X-Forwarded-For/X-Real-IP headers from nginx. Empty CIDR list means "allow all" (useful for testing).
• 404 falls through to the index rather than a sterile error page — lets someone who typo'd a slug find their way back.

Want me to write the skill for the agent integration too, or do you want to tweak anything first?

You 🧑

The skill won't make sense until I operationalize it and get a DNS entry and SSL blah blah, don't worry about that part yet. Let me bang on this thing for a bit, see what I like and don't like and I'll come back to this convo with some feedback.

Assistant 🤖

Sounds good! A couple quick notes for when you're banging on it:

• The dev server is killed now, so cd ~/Personal/tclip && .venv/bin/python app.py to start it back up.
• If you want to test from another machine on your LAN, the .env currently allows 192.168.0.0/16 for POSTs — adjust ALLOWED_POST_CIDR if your network is different.
• Set DEBUG=true in .env if you want auto-reload while iterating.

I'll be here when you're ready.