captoys/capsite-checklist.md

# capsite goal tree

Nested checkboxes form the goal tree itself: each `- [ ]` is a goal; its
indented children are the subgoals/steps that must pass before it (an item
is only checked when **all** its children are checked — or, for leaf
items, when it has passed verification itself). Working notes live under
each goal; [the capsite notes](capsite-notes.md) carry the background
narrative.

- [ ] **EmDash site (madmode) collects diigo.com bookmarks; credentials
      held by the host, never inside the plugin** (background:
      [the capsite notes](capsite-notes.md); after step 2, expands to
      [bib sync #195](https://github.com/dckc/madmode-blog/issues/195))

  - [x] Credential discipline established: cookies/keys/secrets live in
        Worker secrets or DO storage, never in source, config, or the
        plugin. (`.dev.vars` gitignored: only `DIIGO_WEB_ID`;
        cookie lives in the webapp DO's storage since the 1b split.)
  - [x] **1. Cookie-path dump worker** (`diigo-dump/`): port of
        mm-diigo's diigo-dump.mjs. GET inert, dump only on POST.
        Verified 2026-10-06: 200, `total: 1674`. (Scrubbed: static
        API-key ping worker 401'd — the cookie path was the one that
        worked; see the API-key subgoal below for where that left us.)
  - [x] **1b. webapp DO factory** (`webapp/`): credentialed authority
        in a Durable Object; ids are bearer capabilities (not logged);
        factory worker is site-agnostic; consumer holds only the id.
        Dev wiring verified: `pnpm dev` boots both, home + /_connect
        answer on :8787.
        - [ ] 1b-i. Mint through the running dev server end-to-end:
              POST /_mint (or /_connect page) with a fresh cookie →
              id → dump page 1 through the DO → 200/items.
              (Everything up to mint is verified; this closes the loop.)
        - [ ] 1b-ii. Prod mint + handoff: deploy both, mint against
              prod, `wrangler secret put DIIGO_WEB_ID`, dump a page.

  - [ ] **2. madmode collects real bookmarks via the webapp cookie path**
        (API-key path is DEAD — verified in session
        ses_eec320fe4ffehaMAn44U1nTKJU: both known real keys, all
        documented schemes (key= param, key+user=, HTTP Basic), both
        /api/v2/bookmarks and /api/v2/notes → 401 unconditionally, with
        2024–2025 historical proof the same creds once downloaded 13.5k
        bookmarks. Diigo deprecated/revoked v2 key auth; the session-
        cookie /interact_api channel is the one that works.)
        - [ ] 2-i. Plugin rides the webapp DO: plugin's sync calls
              diigo-dump's DiigoBridge (or the instance id directly);
              cookie + host gate stay host-side.
        - [ ] 2-ii. Plugin "Sync now" succeeds: status 200, bookmarks
              stored (admin at /_emdash/admin → Diigo Sync).
        - [ ] 2-iii. Cookie-expiry story for cron: rotation is manual
              (re-mint via /_connect) unless we automate it later.
  - [ ] **3. `/bookmarks` renders real data** after a sync — titles/tags at
        http://localhost:4321/bookmarks.
  - [ ] **4. Cron sync** works locally without errors (`0 */6 * * *` in
        `_emdash_cron_tasks`).
  - [ ] **5. Deployed end-to-end** (order matters; webapp first):
        - [ ] 5-i. webapp: `cd webapp && npx wrangler deploy`
        - [ ] 5-ii. diigo-dump: deploy + prod mint + `wrangler secret
              put DIIGO_WEB_ID` (id from x-diigo-web-id header)
        - [ ] 5-iii. madmode: `pnpm wrangler deploy`, secrets via
              `wrangler secret put`; plugin "Sync now" against prod
  - [ ] **6. bib sync #195**: repeat the pattern for the next
        read-access need.
- [ ] **webapp graduates from prototype** (optional; only if it earns it)
  - [ ] TODO(webapp): one canonical mint form — proxy-page (current) vs
        running webapp as the primary worker so its own port serves the
        form directly; revisit as the UI grows.
  - [ ] @endo/errors for structured error details (needs node_modules).

## How to run (continuation prompts)

Dev (diigo-dump + webapp in one workerd):

    cd ~/oros-bots/capsite/diigo-dump
    pnpm dev                        # → http://localhost:8787
                                    # webapp rides along (binding-only)

First connect (or re-connect after cookie expiry) — browser flow, primary:

    open http://localhost:8787/_connect
    # paste the Cookie header from diigo.com devtools; mint
    # success page shows a copy button for the id
    # add DIIGO_WEB_ID="<id>" to diigo-dump/.dev.vars (only the id lives
    # on disk; the cookie lives in the DO's storage)
    # restart wrangler (pnpm dev) to pick it up

Terminal flow (superseded by the page; needs a display):

    pnpm -s diigo-login >> .dev.vars   # askpass prompt; appends the id line
                                       # (.dev.vars: pnpm stdout noise can
                                       # interleave; grep ^DIIGO_ to clean)

Then: enter a page number on the home page, dump → JSON items. GET /
is inert (no accidental fetches; dumps happen only on POST submits).

madmode (EmDash site; separate worker, separate concerns):

    cd ~/oros-bots/capsite/madmode && pnpm dev   # → :4321
    # admin at /_emdash/admin; dev-bypass auth helper:
    # /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin

## Working rules

Agent working rules are in [AGENTS.md](AGENTS.md) — dev servers are the
user's job; secrets discipline; keep config types generated. They apply
to every goal in this tree.

## Pointers

- [the capsite notes](capsite-notes.md) — the original goal and the EmDash
  native-plugin wiring details
- [the mm-diigo diigo-bak scripts](https://github.com/dckc/mm-diigo) —
  provenance of the fluent client and dump generator (`projects/diigo-bak/`:
  WebApp.js, diigo-dump.mjs, diigo-interact.mjs; mm-diigo commit 7dbb367,
  Oct 6 2026)
- [webapp/README.md](webapp/README.md) — HTTP + RPC surfaces of the
  factory worker; open TODO on the mint-form placement
- [diigo-dump/README.md](diigo-dump/README.md) — consumer wiring and
  run/deploy details