Implements the approved design proposal across every screen.
- Layout: feeds · list · reader panes on desktop (≥1280px), list + reader
with the feeds in a drawer on tablets, one column with a bottom tab bar
(À lire, Focus, Favoris, Flux) on phones.
- List: dense rows with an unread dot, feed initial and square thumbnail
instead of large cards; touch swipe reveals the action (→ lu, ← favori).
The magazine grid stays available as a view toggle.
- Reader: inline pane on desktop, full screen on phones with a bottom
action bar (favori, partager, original, Suivant); collapsible "Résumé IA"
block; "Aa" settings become a bottom sheet on phones.
- Search: the existing /articles/search endpoint gets a UI — ⌘K / "/"
palette on desktop, full screen on phones, with recent searches.
- Mobile "Mes flux" screen: views, subscriptions with errors, theme,
OPML import/export, logout.
- Focus mode: progress bar, counter and labelled buttons.
- Tokens: new paper / deep-forest palette (all text ≥4.5:1), Newsreader +
Inter replace Playfair + Lora (two families instead of four), shared
Icon and FeedAvatar components.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UPyU2LbJ2rTrsgZqQKhH3j
- New Reader (desktop + mobile): loads full content on open, prefetches
the next article, reading progress and time, "Aa" settings (light /
sepia / dark / auto theme, serif / sans / Atkinson Hyperlegible font,
size, line height, measure), Space-to-next, keyboard shortcuts, focus
management, inert background, URL-driven (?a=) so Back closes it.
- Dashboard: cursor pagination, unread/all filter, CSS grid (no masonry),
no re-sorting under the reader, optimistic cache patches instead of
refetch storms, "new articles" banner, error/offline states, j/k/o/m/s/v
shortcuts and help dialog.
- Cards: keyboard-openable, lazy <img>, memoized, touch-only swipe.
- Focus mode: framer drag (drop @use-gesture), Read button, undo restores
unread state, arrow keys.
- WebSocket: single connection, backoff, cache patching, no console logs.
- Contrast fixes (on-nature tokens), 44px targets, lang="fr", reduced
motion, self-hosted fonts, theme applied before first paint.
- Code splitting + vendor chunk, prompt-based PWA updates, smaller
precache, offline cache for opened articles and images, caches cleared
on logout; upgrade react-router (CVE), drop unused deps and assets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security:
- WebSocket events are routed to their owner only (no cross-user leak);
hub close is idempotent (fixes double-close panic), adds ping/pong and
write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.
Performance:
- List endpoints return a plain-text excerpt and reading time instead of
full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
exponential backoff, dedupe before insert, column-safe truncation,
retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
handler, server timeouts; expired sessions purged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude
Antigravity AgentandClaude Opus 5.5
Michael