Site usetu la on vercel - #9
Merged
Merged
Conversation
`fetch` strips `Authorization` when a redirect crosses to another host and strips nothing else, so Binance's `X-MBX-APIKEY`, Kraken's `API-Key` and CoinMarketCap's `X-CMC_PRO_API_KEY` would each have been re-sent to whatever the `Location` named — collectable by anything able to shape a venue's response. Redirects are refused outright; the two requests that legitimately follow one carry no credential and opt back in by name, and guard.sh fails the build on a third. The Anthropic base URL is pinned for the same reason in the other direction: the SDK reads it from the environment, so one line in a shell profile would have sent the whole computed book and the key to a fourth party with the screen still saying Anthropic. Three remote strings reached the screen unbounded. A venue's error text is capped and flattened by `remote()` at the connector that received it — the only place that can tell tula's own words from somebody else's — because Ink draws text verbatim and the connect screen renders the error directly above the refusal it is about. A published checksum is shape-checked before it is printed, since the message carrying it is drawn in the one case the checksum exists for. An address is checked against its own EIP-55 checksum, which needed keccak-256 no runtime ships; a single mistyped character used to read somebody else's book with every number beside it correct. The rest is one defect in different clothes: something answering with more confidence than it had. A failed `eth_call` inside an Aave batch returned null and defaulted to a zero balance, eighteen decimals and the symbol UNKNOWN, so a dropped debt leg made the book read richer and safer while the health factor beside it still rendered. Coinbase's first page was taken as the whole account. A zero or NaN price passed every downstream guard, because `new Decimal(0)` is truthy. A position already past its liquidation trigger rendered `+0.0%` and sorted beside the safest rows on screen. USDD sat in the set of tickers worth a dollar by definition, which would value it at par through the depeg its holder needs the real number for. Hyperliquid's own clock could pin a stale snapshot at "0s ago". The model's numeric tools carried no incompleteness flag at all. Around that: the terminal is handed back on a signal or a crash rather than only on unmount, mouse reports are read as a stream so a swept pointer no longer types into the line, `/` and ctrl+k list the same surface, and every error names a way out — except the two that are tula disagreeing with itself, which keep their stack. CI now stages the whole tree and scans it, since the hook is opt-in and `--no-verify` skips it, and `scan-test.sh` proves the patterns still catch what they claim to. The release notes print `--signer-workflow` like everywhere else: `--repo` alone accepts an attestation from any workflow in the repository, and that is the copy people paste. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`SITE_URL` in `src/version.ts` is where the origin is declared; `install.sh`, `site/lib/site.ts` and `package.json` restate it because they cannot import from there, and `guard.sh` fails the build when the four disagree. Everything published moves with it — the install command, the security page a reader is told to check before trusting a binary, `robots.txt`'s sitemap line and `security.txt`'s `Canonical`. Owning the origin root is also what makes `robots.txt` and `.well-known/` mean anything: under a project path a crawler fetched neither, and both were kept as a written record of a policy nothing enforced. GitHub Pages cannot set a response header at all, which is the reason for the move rather than the domain. `site/vercel.json` sends a CSP, HSTS, `nosniff`, `X-Frame-Options`, `Referrer-Policy` and a `Permissions-Policy`. The CSP is the security page's egress claim enforced — same origin, plus Google Analytics, and nothing else, which the site can honour because it loads no webfont and makes no runtime request. `script-src` keeps `'unsafe-inline'` and cannot lose it: Next inlines the RSC flight payload into every page and `output: 'export'` leaves no middleware to mint a nonce, so the alternative is hashes that change every build. HSTS is deliberately without `preload`, which is slow to undo. `/install.sh` is forced to `text/plain` because the install page tells people to read it before piping it into a shell, and a download prompt is not reading it. The static export stayed after the move. Every route is prerendered, so the origin that serves `install.sh` still runs no code of ours; `basePath` went with the project path it existed for. A Vercel preview builds as production, so the `NODE_ENV` gate alone would have filed every preview deployment's page views as the site's own. `Analytics.tsx` renders on the server, so `VERCEL_ENV` is read at build time and needs no `NEXT_PUBLIC_` exposure; a host that sets none is taken for the real one rather than left silently untagged. `pages.yml`, `public/CNAME` and `public/.nojekyll` go with Pages. Two Vercel settings are now load-bearing and neither lives in this repository: the project root directory is `site`, or `vercel.json` is read from nowhere and every header above silently stops being sent; and the build includes files from outside that root, or the copy of `install.sh` never happens and the published `curl | sh` fetches a 404. Both are rows in the pre-release table in AGENTS.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.