From the final review: proxied archived HTML could run on our origin and read a
remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the
origin check broke behind a TLS proxy; one unreadable snapshot could fail a run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MBSEED_STORAGE_MAX_BYTES (default 1 GiB) limits the folder. Uploads past
it get 507 and nothing is evicted early, since older files may still be
under MangaBaka review.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Server storage is a plain folder (MBSEED_STORAGE_DIR) served at /covers/
with a daily sweep deleting files older than 30 days. S3/R2 remains a
later Storage option.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The user signed off the spec. The server runs self-hosted under Bun;
the password gate and the Cloudflare Workers entry stay designed but
deferred until abuse or traffic calls for them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Image hosts are now server storage (30 days), litterbox (<=72h, direct
from the browser), catbox (permanent) and direct. The server becomes one
web-standard fetch handler with Cloudflare Workers and Bun.serve entries,
and an optional shared password gates every route, assets included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revise the covers spec: both links given directly, static page served by a
Cloudflare Worker plus a userscript on one pure core, Bun instead of Node,
and R2 rehosting with a 30-day expiry. Move the spec to docs/specs/, merge
HANDOVER.md into docs/DECISIONS.md, the spec and docs/TODO.md, and add
AGENTS.md, pointer files, PERMISSIONS.md and agent permission configs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
