at main
17 folders
5 files
chore: remove lint-silenced dead code and a homoglyph identifier
The underscore prefix is the eslint unused-vars escape hatch, so `_name` marks
code kept alive purely to pass lint. Removed:
- four dead aliased imports (slide as _slide x2, fade as _fade, onMount as
_onMount, enhance as _enhance) — each appeared exactly once, at the import
- statistics/+page.svelte's write-only _loading, assigned twice and never read.
Its removal emptied the finally block, which also exposed write-only queryTime
(computed, never read) and two stale 'no longer needed' comments
- two unused _result bindings in alerts.ts; the awaits are kept, only the
discarded bindings go
routes/+page.server.ts declared `dedupeBy<U+0421>pu` using CYRILLIC CAPITAL
LETTER ES instead of Latin C. Consistent between declaration and call, so it
ran correctly — but it could not be found by grepping for dedupeByCpu, and a
homoglyph in an identifier is the shape of a review-evasion trick. Renamed to
ASCII; the file now has no non-ASCII characters at all.
Swept src/, worker/src/, packages/ and scripts/ for Cyrillic and Greek Latin
lookalikes in identifier positions; this was the only one.
The underscore declarations in analyze/+page.svelte are deliberately left for
the reactivity work, where the effect holding them is being restructured.
feat(insights): add computed insight blocks to cloud-status and configurations
Adds a short block of statements derived from each page's own data: which
locations offer ARM at all, the widest and narrowest location by in-stock
share, the scarcest type, anything out of stock everywhere; on configurations,
the entry price, best value per core, the per-TB floor, ECC share and GPU
count.
Every sentence carries a number or name computed at request time, and a
sentence whose precondition does not hold is dropped rather than softened into
something generic -- so a quiet day yields fewer sentences, never filler. The
generators are pure functions colocated with each page and capped at four
statements, which keeps this from drifting into a keyword dump.
Both pages load server-side, so the text is in the initial HTML rather than
appearing only after hydration. /statistics is deliberately left out: it reads
from client-side DuckDB WASM, so text there would be invisible to crawlers
without a new server-side aggregate.
feat(settings): connected-app revocation, fuller export, MCP on landing and guide
- Connected Applications card in settings, listing apps authorized over OAuth
with a Revoke button that deletes both the tokens and the stored consent, so
a later authorization must be approved again rather than resumed silently.
The listing unions oauthAccessToken with oauthConsent. Reading tokens alone
left an app that had been approved but had not yet exchanged its
authorization code invisible — and therefore impossible to revoke. Caught by
driving the flow in a real browser.
- Data export now includes cloud availability alerts and their history,
notification settings, and connected applications; it predated all three. It
shares the settings helper so both report the same grants. Token and client
secret values stay out: they are the application's credentials, not the
user's data, and a downloadable file containing them would be a credential
leak.
- Export button gets data-sveltekit-reload. It is an anchor, so the client
router was starting a navigation to an endpoint that replies with a file and
never completes, leaving the loading bar animating forever.
- Landing page section and guide chapter for the MCP server, covering how to
connect, what needs an account, how to revoke, and the net-of-VAT/IPv4
pricing basis so figures read back from an assistant mean what they say.
fix(cpu-page): correct the price history axis, break gaps, add average
The 90-day chart passed new Date(day).getTime() — milliseconds — to a
component that multiplies by 1000, putting every point ~56 million years
out. The plot shape survived because a constant factor on a self-scaling
axis is invisible, but the tick labels were month/day pairs from dates
centuries apart, which is why they read as running backwards.
Pass epoch seconds, align onto a daily grid so a day with no listing
breaks the line instead of being joined by a segment that implies a
price, and draw the same faded-raw + 7-day-average pair the statistics
page uses.
Chasing it surfaced a robustness hole in buildDayGrid: SQLite's
date(seen) is null for an unparseable timestamp, new Date(null) is epoch
0, and Math.min then stretched the grid back to 1970 — 20,673 points
with the real data one pixel wide. Non-finite and non-positive days are
now dropped before taking the extent, so one bad row costs one point
rather than the chart.
chore: remove lint-silenced dead code and a homoglyph identifier
The underscore prefix is the eslint unused-vars escape hatch, so `_name` marks
code kept alive purely to pass lint. Removed:
- four dead aliased imports (slide as _slide x2, fade as _fade, onMount as
_onMount, enhance as _enhance) — each appeared exactly once, at the import
- statistics/+page.svelte's write-only _loading, assigned twice and never read.
Its removal emptied the finally block, which also exposed write-only queryTime
(computed, never read) and two stale 'no longer needed' comments
- two unused _result bindings in alerts.ts; the awaits are kept, only the
discarded bindings go
routes/+page.server.ts declared `dedupeBy<U+0421>pu` using CYRILLIC CAPITAL
LETTER ES instead of Latin C. Consistent between declaration and call, so it
ran correctly — but it could not be found by grepping for dedupeByCpu, and a
homoglyph in an identifier is the shape of a review-evasion trick. Renamed to
ASCII; the file now has no non-ASCII characters at all.
Swept src/, worker/src/, packages/ and scripts/ for Cyrillic and Greek Latin
lookalikes in identifier positions; this was the only one.
The underscore declarations in analyze/+page.svelte are deliberately left for
the reactivity work, where the effect holding them is being restructured.
feat(settings): connected-app revocation, fuller export, MCP on landing and guide
- Connected Applications card in settings, listing apps authorized over OAuth
with a Revoke button that deletes both the tokens and the stored consent, so
a later authorization must be approved again rather than resumed silently.
The listing unions oauthAccessToken with oauthConsent. Reading tokens alone
left an app that had been approved but had not yet exchanged its
authorization code invisible — and therefore impossible to revoke. Caught by
driving the flow in a real browser.
- Data export now includes cloud availability alerts and their history,
notification settings, and connected applications; it predated all three. It
shares the settings helper so both report the same grants. Token and client
secret values stay out: they are the application's credentials, not the
user's data, and a downloadable file containing them would be a credential
leak.
- Export button gets data-sveltekit-reload. It is an anchor, so the client
router was starting a navigation to an endpoint that replies with a file and
never completes, leaving the loading bar animating forever.
- Landing page section and guide chapter for the MCP server, covering how to
connect, what needs an account, how to revoke, and the net-of-VAT/IPv4
pricing basis so figures read back from an assistant mean what they say.