title: [security] Mitigate SSRF in Image Proxy and Feed Fetcher

description: Restrict outbound HTTP requests to prevent access to internal networks. 1. Create a custom http.Transport for the fetcher clients. 2. In the DialContext, resolve the IP address of the target hostname. 3. Block connections to private IP ranges (RFC 1918) and loopback addresses (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). 4. Disable following redirects to private IPs.

status: closed


title: Implement Frontend Logout

description: Add logout button/link in dashboard and call /api/logout.

type: task


title: Add documentation for background crawler behavior

description: Document how the background crawler works in README.md: explain the --minutes flag, default behavior (60 minutes), how to disable background crawling (set to 0 or omit flag), and manual crawling with --update flag.


title: Implement Frontend Settings

description: Create settings page for managing feeds/categories.


title: docker compose fails

description:
When running docker compose up I got the following error:
[2/3] STEP 1/9: FROM golang:1.23-bullseye AS backend-builder
Resolved "golang" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/golang:1.23-bullseye...
Getting image source signatures
Copying blob sha256:bb30cea4afcbc0a0405508119c28d87afb4518e3558e2f1fb0a52a0498994287
Copying blob sha256:a9acb5a6634ff8f020bd4562c483cdd83503103d2c080d87e777643b57123e41
Copying blob sha256:b26972d9a448e4dba0ac85216372d6ee52bc89839590b4e97f94b77ced5571fe
Copying blob sha256:b1efd17e5717172aa4463c9c599bce51a6939b602dbb135bf6c26d672a6e7496
Copying blob sha256:6a887974b056452b76229e3392cbf8513e741cd3dcd1f05e7397eea6fce361a0
Copying blob sha256:382d65ac76ebcbc7ba7ee0d232ae7afbec48e2b3b673983ac8ced522dabe3abb
Copying blob sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1
Copying config sha256:6f1643fb9acc4fc0b9bf95efd1b4b1cd274dcd73a39cc99ef57da203d7088f42
Writing manifest to image destination
[2/3] STEP 2/9: RUN go install github.com/GeertJohan/go.rice/rice@latest
go: downloading github.com/GeertJohan/go.rice v1.0.3
go: downloading github.com/GeertJohan/go.incremental v1.0.0
go: downloading github.com/akavel/rsrc v0.8.0
go: downloading github.com/daaku/go.zipexe v1.0.2
go: downloading github.com/jessevdk/go-flags v1.4.0
go: downloading github.com/nkovacs/streamquote v1.0.0
go: downloading github.com/valyala/fasttemplate v1.0.1
go: downloading github.com/valyala/bytebufferpool v1.0.0
--> 181d1254149e
[2/3] STEP 3/9: WORKDIR /app
--> 3f497307e2ca
[2/3] STEP 4/9: COPY go.mod go.sum ./
--> 339c24ca12cd
[2/3] STEP 5/9: RUN go mod download
go: go.mod requires go >= 1.24.2 (running go 1.23.12; GOTOOLCHAIN=local)
Error: building at STEP "RUN go mod download": while running runtime: exit status 1

type: bug


title: refactor backend to have a clean API

description:
create a nice clean API for the backend GO code that is more independent of the frontend

ensure that it is working with good tests


title: Increase Test Coverage to >80%

description: Project-wide test coverage is currently ~63%. Key gaps are in the new  and  packages, as well as some core model logic. Increase coverage to at least 80% to ensure stability.


title: Mobile Layout Verification for New Frontend

description: Verify and adjust the new fixed-width layout for mobile devices to ensure responsiveness.


title: delete vanilla js prototype

description: remove it, let's just focus on the react version. make sure everything still builds cleanly, etc after removing. remove any old tests for it, etc.


title: Prototype Vanilla JS Frontend

type: feature


title: Vanilla JS: Implement Search

description: Add search bar to vanilla JS prototype and hook up to search API.


title: v2 frontend move the star to the RIGHT of the title

description: Look at the old implementation and make it look more like that! Big start, same size as the article title.


title: go vet fails on github ci

description:
Looks like the newly enabled github ci runs go vet and got a bunch of errors including:

go vet ./...
  shell: /usr/bin/bash -e {0}
Error: config/config.go:6:2: missing go.sum entry for module providing package gopkg.in/yaml.v2 (imported by adammathes.com/neko/config); to add:
    go get adammathes.com/neko/config
Error: models/db.go:10:2: missing go.sum entry for module providing package github.com/mattn/go-sqlite3 (imported by adammathes.com/neko/models); to add:
    go get adammathes.com/neko/models
Error: models/feed/feed.go:10:2: missing go.sum entry for module providing package github.com/PuerkitoBio/goquery (imported by adammathes.com/neko/models/feed); to add:
    go get adammathes.com/neko/models/feed
Error: models/item/item.go:12:2: missing go.sum entry for module providing package github.com/advancedlogic/GoOse (imported by adammathes.com/neko/models/item); to add:
    go get adammathes.com/neko/models/item
Error: models/item/item.go:13:2: missing go.sum entry for module providing package github.com/microcosm-cc/bluemonday (imported by adammathes.com/neko/models/item); to add:
    go get adammathes.com/neko/models/item
Error: models/item/item.go:14:2: missing go.sum entry for module providing package github.com/russross/blackfriday (imported by adammathes.com/neko/models/item); to add:
    go get adammathes.com/neko/models/item
Error: crawler/crawler.go:7:2: missing go.sum entry for module providing package github.com/mmcdole/gofeed (imported by adammathes.com/neko/crawler); to add:
    go get adammathes.com/neko/crawler
Error: tui/tui.go:9:2: missing go.sum entry for module providing package github.com/charmbracelet/bubbles/list (imported by adammathes.com/neko/tui); to add:
    go get adammathes.com/neko/tui
Error: tui/tui.go:10:2: missing go.sum entry for module providing package github.com/charmbracelet/bubbles/viewport (imported by adammathes.com/neko/tui); to add:
    go get adammathes.com/neko/tui
Error: tui/tui.go:11:2: missing go.sum entry for module providing package github.com/charmbracelet/bubbletea (imported by adammathes.com/neko/tui); to add:
    go get adammathes.com/neko/tui
Error: tui/style.go:3:8: missing go.sum entry for module providing package github.com/charmbracelet/lipgloss (imported by adammathes.com/neko/tui); to add:
    go get adammathes.com/neko/tui
Error: web/web.go:19:2: missing go.sum entry for module providing package github.com/GeertJohan/go.rice (imported by adammathes.com/neko/web); to add:
    go get adammathes.com/neko/web
Error: web/rice-box.go:7:2: missing go.sum entry for module providing package github.com/GeertJohan/go.rice/embedded (imported by adammathes.com/neko/web); to add:
    go get adammathes.com/neko/web
Error: web/web.go:20:2: missing go.sum entry for module providing package golang.org/x/crypto/bcrypt (imported by adammathes.com/neko/web); to add:
    go get adammathes.com/neko/web
Error: main.go:16:2: missing go.sum entry for module providing package github.com/ogier/pflag (imported by adammathes.com/neko); to add:
    go get adammathes.com/neko
Error: Process completed with exit code 1.


title: Add crawl status indicator to UI

description: Currently triggering a crawl via 'Crawl All Feeds Now' just shows an alert. We should provide a visual status indicator and refresh the item list automatically when done.


title: Create 'make check' unified workflow

description: Create a 'make check' target that runs 'golangci-lint' (replacing 'go vet') and all unit tests (Backend + Frontend). This becomes the fast (<30s) 'Golden Command' for local verification.


title: Install golangci-lint in dev environment

description: Local Makefile uses 'go vet' because 'golangci-lint' is missing. CI uses golangci-lint. We should install it locally for consistency.


title: terminal UI

description: once there is good test coverage and a clean backend API, work on a nice efficient TUI with https://github.com/charmbracelet/bubbletea


title: Vanilla JS: Add Feed UI

description: Add UI to add a new feed by URL in vanilla JS prototype.


title: Bulk edit feeds in settings

description: Allow selecting multiple feeds to delete or tag at once.


title: Make feed crawling async in API

description: Currently, POST /api/feed triggers an immediate crawl which blocks the response (or at least keeps the goroutine alive). Refactor the crawling architecture to be truly async with a job queue or status updates, improving API responsiveness and reliability.

type: cleanup

status: icebox


title: v3: cut "FILTERS" text

description: there's no header needed above unread/read/starred, just cut that please


title: Implement Item Interactions

description: Add ability to toggle read/unread and star/unstar status for items. Use PUT /item/:id


title: run the performance test suite and provide some benchmarks

description: Create a document in DOCS after running the perf test suite with findings and potential improvements.


title: check coverage again

description: check test coverage again and see if more tests are needed


title: Refactor routing logic for consistent settings exit

description: Instead of checking 'if currentRoute.path == /settings' in every click handler, maybe centralize this logic in the router or a helper function to ensure consistent behavior when navigating away from settings.


title: Re-enable and fix errcheck lints

description: Re-enable 'errcheck' in .golangci.yml and fix the remaining ~140 issues, mostly related to unchecked Writes and DB operations.


title: Fix and Re-enable Playwright E2E Tests

description: E2E tests were crashing the VM and timing out. Disabled them in package.json. Need to investigate resource usage and re-enable.


title: v2 ui bug - panel open by default

description: Panel is closed by default, it should be open by default on desktop.


title: serve "legacy" version UI at /v1/ instead of /

description: Let's "softly" start to deprecated the legacy version by moving it to /v1/ -- ideally this won't require any changes but there may be some relative/absolute URLs to adjust in the static files there or in rouoting


title: Mock RSS feeds in E2E tests

description: Currently E2E tests fetch real feeds like CNN, which makes them slow (10s+) and potentially flaky depending on network. Use a local mock server or file-based mocks.


title: Implement Tag View

description: Create frontend view for browsing items by tag/category. Use /tag/:id endpoint.


title: make new v2 UI the default and serve at /

description:
After we move the old UI to be served at v1, serve the new UI at /

We can keep serving it at v2/ as well if we want.


title: Vanilla JS (v3): Redesign to 2-pane glassmorphism (parity with v2)


title: Implement ClientLogin and Token endpoints


title: Implement Stream Contents endpoint


title: get rid of the "selected" highlight thing

description: the legacy version doesn't do that and i find it distracting, j/k just move things up/down


title: Crawler testing

description:
The general usage of neko is to run it and have it crawl feeds in the background after X minutes

Do we have a test that can verify that's happening


title: UI Styling: Controls & Header


title: Implement Subscription List and UserInfo endpoints


title: username + password

description:
it's too weird to have just a password -- in the old UI i had a username but it was just ignored. but password managers get confused by this new no username thing.

let's make it so you can enter a username and password. to start, just let that be a no-op (it ignores the username and just pays attention to the password.)

we can consider later on if we want to make the username real and definable too.


title: Enable Gzip Compression in Go Backend

description: Check if the Go backend is serving content with gzip compression. If not, implement it to reduce page size and improve performance. Add tests to verify.


title: new web frontend

description:
The current frontend uses an old version of backbone and jquery. Let's "deprecate" it -- keep it arouond so we can test against it and use it, but let's be able to also serve and use a nice shiny new frontend written in either simiple, highly efficient vanilla javascript, or put together something in react or similar. Needs to feel fast and low latency!

It's very important that this new frontend has all the functionality of the existing one AND looks similar (use same style, etc, but adjust a little if needed.)

ALSO make it highly testable and have high test coverage as you go. I don't want it to use the Chrome browser plugin thing, just test it on your own using things from the command line you can do.

type: epic


title: Wire Reader API into web.go


title: make sure the github CI jobs are included in the tests/jobs locally!


title: v2 ui - font size adjustments

description: Move font-size: 18px to :root so rem units resolve correctly. Adjust title size to ~24px.


title: E2E Testing

description: Set up E2E testing with Playwright or Cypress to verify full flows: Login -> View Feeds -> View Items -> Logout


title: security changes broke legacy

description:
I think some of the security policies make it so the old legacy one doesn't work. this may just be WAI but have a look

[Warning] jQuery.Deferred exception: Refused to evaluate a string as JavaScript because 'unsafe-eval' or 'trusted-types-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'". (jquery-3.3.1.min.js, line 2)
 (2)
"Function@[native code]
o@http://localhost:4994/static/jquery.tmpl.min.js:10:3543
template@http://localhost:4994/static/jquery.tmpl.min.js:10:1914
tmpl@http://localhost:4994/static/jquery.tmpl.min.js:10:1422
render@http://localhost:4994/static/ui.js:208:23
nr@http://localhost:4994/static/underscore-1.13.1.min.js:6:7308
@http://localhost:4994/static/underscore-1.13.1.min.js:6:7733
@http://localhost:4994/static/underscore-1.13.1.min.js:6:786
boot@http://localhost:4994/static/ui.js:598:28
@http://localhost:4994/static/ui.js:8:9
l@http://localhost:4994/static/jquery-3.3.1.min.js:2:29380
@http://localhost:4994/static/jquery-3.3.1.min.js:2:29678"
undefined


title: Vanilla JS (v3): Basic Fetch and Feed List


title: Scaffold Vanilla JS Frontend (v3)


title: Vanilla JS: Test Infrastructure & Coverage

description: Setup testing framework (likely vitest or simple runner) for vanilla JS. Refactor code for testability. Aim for 80% coverage on vanilla/app.js logic.


title: test coverage

description:
assume the code works properly (it mostly does)
get to 90% test coverage on the go code


title: add "star" back in

description: rather than the word "star" it should just have a star that changes colors right next to the title


title: Fix backend linting issues reported by golangci-lint

description: golangci-lint reports 64 issues including 46 errcheck violations (ignored errors in web handlers), 13 staticcheck issues (e.g., using 307/401 literals instead of http constants), and minor formatting/unused param issues. These should be addressed to improve code quality.


title: slow scrolling in v2 ui compared to v1

description: When using j/k to go to the next feed, they appeared instantly, now it feels like a slow scroll. Make it speedy again.


title: UI Styling: Sidebar (Fixed, Gray Background)