Lucas WintherandClaude Opus 5.5 baa3476b73 fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host ...

From the final review: proxied archived HTML could run on our origin and read a
remembered token; /api/upload accepted any Wayback URL and GIF-prefixed bytes; the
origin check broke behind a TLS proxy; one unreadable snapshot could fail a run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-15 01:49:52 +02:00

..

history

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

hosting

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

mangabaka

feat(core): MangaBaka client (paginated public reads; snapshot, preview, save for review)

2026-10-14 23:38:08 +02:00

seed

feat(core): build the cover seed (whole set, one default) and manual-entry text

2026-10-14 23:38:15 +02:00

sources

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

covers.ts

feat(core): merge, dedupe, compare with MangaBaka, pick the default, write notes

2026-10-14 23:37:48 +02:00

html.ts

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

images.ts

feat(core): inspect images (size from headers, sha256, shape incl. landing-page art)

2026-10-14 23:37:41 +02:00

links.ts

feat(core): parse MangaBaka and Webtoons links; normalise Webtoons image URLs

2026-10-14 23:36:52 +02:00

model.ts

feat(core): model types and transport policy (pacing, retries, timeouts, token scope)

2026-10-14 23:36:34 +02:00

pipeline.ts

feat(core): compose the pipeline (links → series → current + history → inspect → compare)

2026-10-14 23:38:48 +02:00

session.ts

feat(core): shared review session (cards, main cover, rehost, manual text, token flow)

2026-10-14 23:38:54 +02:00

transport.ts

fix(server): inert proxy responses, API-call header, image-only uploads; origin check by host

2026-10-15 01:49:52 +02:00

version.ts

chore: scaffold Bun + TypeScript with core boundary test; record verified commands

2026-10-14 23:34:18 +02:00