Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

Back to skills

Bootgs Client

ASecurity

Explains bootgs' Virtual Transport Layer contract (how doGet/doPost events must be shaped for the router to resolve a controller method) and how to build a client that calls a bootgs backend from a web app UI, an HtmlService sidebar/dialog via google.script.run, or a deployed web app URL. Use when building a frontend that talks to bootgs controllers, or when requests aren't reaching the expected route.

5 stars
0 votes
0 copies
0 views
Added 9/19/2026
ai-agentsgodebuggingapifrontendbackend

Works with

cliapi

Security Analysis

A100/100

Scanned 9/19/2026

Install to Claude Code

$npx -y skills add bootgs/skills --skill bootgs-client --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Bootgs Client?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Bootgs Client
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/bootgs-bootgs-client/badge)](https://www.skillsdirectory.com/skills/bootgs-bootgs-client)

More formats (shields.io, HTML) on the badges page.

Download Zip
Files
SKILL.md
---
name: bootgs-client
description: Explains bootgs' Virtual Transport Layer contract (how doGet/doPost events must be shaped for the router to resolve a controller method) and how to build a client that calls a bootgs backend from a web app UI, an HtmlService sidebar/dialog via google.script.run, or a deployed web app URL. Use when building a frontend that talks to bootgs controllers, or when requests aren't reaching the expected route.
license: Apache-2.0
metadata:
  author: Maksym Stoianov
  version: "1.0.0"
  framework: bootgs
---

# Bootgs Client

## Available files

- **`assets/gas-http-client.ts`** — a working `callBootgsApi()` client built on `google.script.run` (see below). Copy it in and adapt.

## Why this exists

A bootgs controller method is triggered by GAS calling the native `doGet(event)`/`doPost(event)` globals — GAS hands you an event object shaped by its own trigger system, not a URL and HTTP method your `fetch` call understands. bootgs's `RequestFactory` reconstructs an `HttpRequest` (method, pathname, query, body) out of that native event. The **Virtual Transport Layer** is the convention for what to put into the event so that reconstruction resolves to the route you intend. There is no bootgs-provided client — you build the caller side yourself, against this contract.

## The contract

| Field | Where it comes from | Notes |
|---|---|---|
| `method` | a `method` parameter (`GET`, `POST`, `PUT`, `DELETE`, ...) | This is virtual — GAS itself only ever actually invokes `doGet` or `doPost`. `method` tells the router which route to match, independent of which GAS global fired. |
| `pathname` (or `path`) | a `pathname`/`path` parameter | Must include the `apiPrefix` your app was configured with (default `"/api"`) — see `bootgs-quickstart`. Route placeholders (`{id}`) must already be substituted with real values; the router does not template on the client's behalf. |
| query params | plain key/value entries in the event's `parameter`/`parameters` map | Same map that carries `method`/`pathname` — GAS doesn't distinguish "framework" params from "your" params, they're all just query-string-derived key/values. |
| body | `postData.contents` (string) + `postData.type` | Only present on `doPost`. Send a JSON string and set `postData.type` to bootgs's `ContentMimeType.JSON` so the body is parsed rather than treated as opaque text. |
| headers | not natively supported | GAS triggers don't carry HTTP headers. If you need to pass metadata that isn't a query param or body field, JSON-stringify it into a `headers` parameter — this is a workaround, not a real header channel. |

## Two transport modes

**1. Deployed web app, called over real HTTP.** If `webapp.access` allows it, the `/exec` URL accepts real requests — but GAS always receives them as `doGet` or `doPost` regardless of the actual verb the browser sent, so `method` still travels as a query/body parameter, not as the request's real HTTP verb. A plain `fetch`/`axios` call works; just always target `doGet` with `POST`/`PUT`/`DELETE` mapped through the `method` param if you want to avoid CORS preflights, or `doPost` directly if the body needs to travel as `postData`.

**2. Embedded in Sheets/Docs/Slides (sidebar or dialog), via `google.script.run`.** No real HTTP exists here — you call the global proxy directly and construct the event object yourself:

```ts
function callBootgs(fnName: "doGet" | "doPost", event: Partial<GoogleAppsScript.Events.DoGet | GoogleAppsScript.Events.DoPost>) {
  return new Promise((resolve, reject) => {
    google.script.run
      .withSuccessHandler(resolve)
      .withFailureHandler(reject)
      [fnName](event);
  });
}
```

See `assets/gas-http-client.ts` for a complete, minimal client built on this that exposes a `fetch`-like `callBootgsApi(method, pathname, { query, body })` function — copy it in and adapt the parameter-map construction to your controllers.

## Gotchas

- **`apiPrefix` mismatch is the #1 "route not found" cause.** If the app was created with the default config, every path must start with `/api` — a client calling `/widgets` instead of `/api/widgets` gets a clean miss with no obvious error pointing at the prefix.
- **Path parameters are not templated for you.** bootgs's routes use `{id}`-style placeholders server-side (OpenAPI-compatible — see `bootgs-openapi`), but the client must send the already-substituted concrete path (`/api/v1/widgets/42`), not the placeholder form.
- **`google.script.run` callbacks are not promises.** Always wrap `withSuccessHandler`/`withFailureHandler` yourself (as above) before treating the call as awaitable — awaiting the bare `google.script.run[...]` call resolves immediately with the proxy object, not the result.
- **No real headers.** Don't design an auth scheme that depends on an `Authorization` header reaching the controller — it won't. Pass tokens as a body field or query param instead.
- **This pattern is safe from the private-function-naming pitfall, but only because it always targets `doGet`/`doPost`.** If the same add-on also exposes plain `google.script.run` calls outside the bootgs router — a menu action, a settings dialog — those functions must be public (no trailing `_`) or the call silently does nothing. See `apps-script-ui`.

## Verification

Before debugging further into bootgs internals, log the exact object your client builds and check it field-by-field against the contract table above (`method`, `pathname`, query params, `postData.contents`) — a malformed transport-layer payload is a far more common cause of "wrong controller called" or "404" than a router bug.

Attribution

bootgsbootgs
View sourceMore from bootgs →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Caveman

Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.

1023331 votes

Hyperplan

Adversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', ...

686011 votes

Mcp Code Execution

Routes multi-tool workflows through MCP servers for large datasets and pipelines. Use when Bash tool overhead is limiting throughput on data-heavy tasks.

3331 votes

catchup

Recovers prior coding-agent session context by running `catchup <agent> --since-compact`, which extracts a clean summary of a previous Codex, Claude Code, Antigravity, OpenCode, or Pi Agent session. Use when the user says "catch up", "what did the last session do", "get me up to speed", "I switched agents", or asks to recover/summarize a previous session before continuing. Do NOT use for the current conversation, git history, or any non-agent log.

611 votes

math-skill

A comprehensive mathematical reasoning skill for AI assistants — handles arithmetic to research-level problems with rigorous step-by-step reasoning, systematic verification, and transparent uncertainty handling

381 votes
View all in ai-agents →