From the final review: proxied archived HTML could run on our origin and read a remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the origin check broke behind a TLS proxy; one unreadable snapshot could fail a run. Co-Authored-By: Claude Opus 5.5 <[email protected]>
4.1 KiB
4.1 KiB
TODO
Durable backlog. Agents append here instead of leaving TODO comments in source.
Small, specific, independently actionable. Remove only when actually done.
Design: specs/001-webtoons-covers.md.
Now
- User smoke test in a real browser: the page (local server) and the userscript in Tampermonkey or Violentmonkey on a MangaBaka series page — Tower of God (9999 / title_no 95). The agent ran both in headless Chrome (the userscript with a GM shim); a real GM install is still untested.
- Deploy (needs the user): which server and domain (
MBSEED_PUBLIC_URL), where the covers folder lives, whether the 1 GiB cap suits the disk, reverse proxy with TLS that appendsX-Forwarded-For.
Next
- Capture MangaBaka snapshot / preview / save responses once someone with API access runs the token flow;
replace the inline OpenAPI-shaped bodies in
test/mangabaka-client.test.tsandtest/session.test.ts. - Check whether MangaBaka's
hashes.sha256matches the original bytes (spec §7.7): compare a cover we submitted with its hash on MangaBaka. If it doesn't, "already on MangaBaka" never matches. - Userscript: fill MangaBaka's cover form for users without a token (spec §4.9) — needs the logged-in form's markup and a check that it accepts programmatic input (spec §7.5). The panel offers copy-and-paste instead.
- Small fixes from the final review (deferred as minor): a malformed
Locationon a proxied redirect gives 500 instead of 502; cap the/api/uploadJSON body size (maxRequestBodySize); after Preview, re-rundraw()so the button respects an unconfirmed link mismatch and the counts refresh after a partial upload; label the "direct" host's URL as "Source URL", not "Rehosted". - Mobile layout (the user deferred it, 2026-10-15): the page stacks under 1000px but was only checked at 760px.
Verify with real services (once possible)
- Which of our servers and domain hosts it (
MBSEED_PUBLIC_URL); where the covers folder lives. - Does catbox accept uploads from our server?
- Does MangaBaka accept our storage URLs, litterbox/catbox URLs, and
swebtoon-phinf.pstatic.net(direct)? - Does MangaBaka copy images on submission or on approval?
- Is "main cover" really
is_default: true? Ask on the MangaBaka Discord if unclear. - Where are personal access tokens created in the MangaBaka UI? Add it to the README.
- Does the MangaBaka cover form accept fields filled by a userscript?
Someday
- S3-compatible bucket as a
Storageoption, if a single server's disk stops being enough. - Password gate (spec §4.11) — only if the open site gets abused or traffic grows too large.
- Cloudflare Workers entry (
server/worker.ts, R2 binding). If added: Workers serve static assets before the Worker unlessrun_worker_firstis set — needed for the gate to cover them. - Bun CLI on the same core.
- More sources: Tapas, Tappytoon, Lezhin, Manta.
- Following Webtoons language editions of the same series.
- Edits beyond covers (series fields, links), via other submission resources.
- CI: check
AGENTS.md,CLAUDE.md,GEMINI.mdand thedocs/paths exist; fail ifAGENTS.mdexceeds 150 lines.
Recurring
- Maintain
AGENTS.md:- Add a rule only in response to a real failure. When an agent repeatedly gets something wrong, that is a gap; add one line, ideally with a code example. Do not pre-empt hypothetical mistakes.
- Update in the same PR as the convention change. A stale rules file is worse than none — it actively misleads.
- Prune quarterly. Delete rules whose convention has changed or whose mistake no longer occurs.
- Optional, cheap validation: run the same task twice in clean sessions, with and without the file, and compare steps and token use.
Known issues
- Wayback answers vary run to run: the same Tower of God run found 17 or 18 covers (a capture month can be missing from one index response). Rerunning is the remedy; nothing is lost.