V0.1.1 release, close to actual release. Bug & security fixes/improvements.

agent3_batch2.md

@@ -0,0 +1,47 @@
+# Agent 3 — Batch 2 Implementation Report
+
+## Scope
+Frontend-only update for Batch 2: wire the "Report Content directly" UI to call a web API instead of opening a Telegram deep link, and fix the hardcoded bot username.
+
+## Files Changed
+
+### 1. `frontend/src/lib/api.js`
+- **Change:** Exported `API_BASE` so it can be imported by `Home.svelte`.
+- **Before:** `const API_BASE = "http://127.0.0.1:8090";`
+- **After:** `export const API_BASE = "http://127.0.0.1:8090";`
+
+### 2. `frontend/src/routes/Home.svelte`
+- **Import:** Added `API_BASE` to the import from `../lib/api.js`.
+- **State:** Added `reportStatus` and `reportStatusIsError` reactive state variables.
+- **Function:** Added `submitDirectReport()` async function that:
+  1. Validates `reportCxid` is non-empty.
+  2. Sends `POST ${API_BASE}/api/content/${encodeURIComponent(reportCxid.trim())}/report` with JSON body `{ reason: "Direct web report" }`.
+  3. On success: sets `reportStatus = "Report submitted successfully."`, clears `reportCxid`.
+  4. On error: sets `reportStatus` to the error message and `reportStatusIsError = true`.
+- **Template — "Report Content via Telegram":**
+  - Replaced hardcoded `harmfulmeowbot` with `${BOT_USERNAME}`.
+  - Kept deep-link parameter `?start=submit` as before.
+- **Template — "Report Content directly":**
+  - Removed the `<a>` wrapper around the Submit button.
+  - Changed the button to `onclick={submitDirectReport}`.
+  - Added conditional status paragraph below the input row that shows green text on success and red (`var(--retro-danger)`) on error.
+- **Styling:** Added `.report-status` CSS rule inside the existing `<style>` block.
+
+## Build Result
+```
+> cgcx-frontend@0.1.0 build
+> vite build
+
+✓ built in 3.51s
+```
+**Result: PASS**
+
+## Open Risks / Follow-up
+1. **Backend endpoint missing:** The server currently has no `POST /api/content/:cxid/report` route. The frontend will receive `404 Not Found` until the backend endpoint is added in `crates/cgcx-server/src/main.rs`.
+2. **Backend tasks still pending (per plan):**
+   - Add `reqwest` to `crates/cgcx-server/Cargo.toml`.
+   - Implement `POST /api/content/:cxid/report` handler (DB insert via `ReportRepo`, then forward notification to Telegram review groups via Bot API HTTP call).
+3. **Path assumption:** The frontend uses `/api/content/:cxid/report` as suggested in the task instructions. If the backend implementation chooses a different path (e.g., `/api/report` with body fields), the frontend fetch URL will need to be updated to match.
+
+## Recommended Next Step
+Implement the backend `POST /api/content/:cxid/report` endpoint so the frontend submission actually works end-to-end.