tts-voice-creator-clone-and-design-2/TODO.md

TTS Voice Creator Roadmap

This roadmap is ordered by priority. Refactors should be incremental and covered by tests before behavior is changed.

Priority levels:

• P0 — safety: prevents crashes, data loss, broken releases, or security incidents.
• P1 — high impact: improves memory use, responsiveness, and maintainability.
• P2 — quality: improves diagnostics, polish, and long-term operations.

P0 — Testing, data safety, and resource limits

• Establish a Playwright baseline before large refactors (app shell, bundle, i18n, clone tabs, and Rehearser parsing; installed Chromium supported).
• Add explicit Docker memory limits where appropriate.
• Limit upload sizes, temporary files, and concurrent jobs.
• Use atomic writes for .meta.json files.
• Create automatic backups before bulk deletes, voice moves, and recasts.
• Add request-size limits, rate limits, and authentication for destructive/API endpoints.

P1 — Modular frontend architecture

• Split audiobook.js, rehearser.js, and style.css by responsibility.
• Replace broad globals with namespaces such as window.TTVC.audiobook.
• Generate loader.js and scripts/minify.mjs from one module manifest.
• Add linting and duplicate-function checks.
• Extract Rehearser voice matching and voice design.
• Extract Audiobook parsing and casting.
• Split style.css by feature.
• Do not migrate to TypeScript or rewrite the frontend until behavior is covered by tests.

P1 — Frontend performance and memory safety

• Lazy-load Audiobook, Rehearser, Studio, and image-generation modules only when opened.
• Virtualize or paginate large character and voice tables; render approximately 30–50 visible rows.
• Cache /api/voices with explicit invalidation instead of repeated full scans.
• Lazy-load profile images and concept art.
• Update only affected table rows instead of rebuilding entire tables.
• Add an LRU cache for audio and images and remove old entries automatically.
• Revoke discarded object URLs with URL.revokeObjectURL(objectUrl).
• Add low-memory mode using navigator.deviceMemory where available; shared worker pools cap at two tasks on devices reporting approximately 4 GB RAM or less.
• Disable image preloading and reduce table/cache sizes on devices with approximately 4 GB RAM.

P1 — Backend stability and bounded concurrency

• Introduce background jobs for voice design, transcription, casting, and image generation.
• Give every job an ID, progress, cancellation, timeout, retry, and idempotency key.
• Prevent duplicate generation when a user clicks twice.
• Centralize provider health checks and error handling.
• Limit concurrency to 1–2 image generations, 1–2 voice generations, and 1 STT request per user.
• Use bounded server queues.

P0 — Security

• Never expose API keys to frontend JavaScript or logs.
• Validate uploaded filenames and paths.
• Strictly validate custom URLs to prevent SSRF.
• Add request-size limits, rate limits, and authentication for destructive/API endpoints.
• Run containers as non-root with dropped capabilities and read-only filesystems where practical.
• Isolate Docker socket access behind a minimal privileged service.

P0 — Data integrity and recovery

• Validate character sheets and voice metadata with schemas.
• Add database migrations instead of silently changing record shapes.
• Use atomic writes for .meta.json files.
• Create automatic backups before bulk deletes, voice moves, and recasts.
• Store prompt versions and generation history so bad regenerations can be reverted.

P0 — Testing

Automated tests

• Character parsing and phantom-speaker prevention.
• Voice-matching constraints.
• Profile-completeness counting.
• Rating persistence.
• STT endpoint normalization.
• ComfyUI workflow submission.
• API failure and timeout behavior.

Playwright smoke suite

• Load the app.
• Verify the production bundle loads.
• Verify language switching and Rehearser parsing.
• Verify clone source tabs switch correctly.
• Open Characters / Cast.
• Sort the profile column.
• Hide and show columns.
• Rate a voice.
• Start and cancel a generation job.

P2 — Observability

• Add structured logs with request and job IDs.
• Report provider, endpoint, duration, and error reason clearly.
• Separate health status from “configured”.
• Add visible job history and retry controls.
• Avoid logging prompts, API keys, or book contents by default.

P1 — Resource limits and constrained-device testing

• Add explicit Docker memory limits, for example mem_limit: 4g and mem_reservation: 1g where appropriate.
• Limit upload sizes, temporary files, and concurrent jobs.
• Test with Chrome DevTools CPU/memory throttling.
• Test in a VM or container limited to 4 GB RAM.
• Monitor browser-tab memory, JavaScript heap, DOM-node count, active audio blobs, Docker memory, and temporary disk usage.
• Add a memory diagnostics page showing browser heap where supported, rendered rows, cache count/size, active jobs, server/container memory, and largest recent operations.