docs(shortcuts): honest framing for the iCloud links section - #16
Merged
Conversation
PR #13 added a Settings card where the user pasted an iCloud share URL and tapped to install. The framing implied "for future devices" — but iCloud already auto-syncs Shortcuts across all Apple devices on the same Apple ID, making the URL field redundant for the single-user case. The remaining real use case (sharing with a different Apple ID: fork users, family) doesn't justify the in-app UI for a tool with zero current fork users. Shifting that capability into docs only: how to publish an iCloud link from Shortcuts and share with someone who's not on your iCloud account. Reverts: - src/lib/client/prefs.ts — drop `siriShortcutUrl` field from Prefs + DEFAULT_PREFS - src/routes/settings/+page.svelte — drop the entire "Siri shortcut" section, the saveShortcutUrl() / isLikelyValidIcloudUrl() helpers, and their imports Updates: - docs/shortcuts.md — replace the "Two ways to install" section (which referenced the now-removed Settings card) with a single "Sharing a shortcut with someone else" subsection covering the iCloud-link share flow with the placeholder-host trick. Mentions upfront that iCloud auto-syncs to your own devices so no manual step is needed for personal portability. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The "Re-publishing iCloud links" intro said the links were for "future-you (or fork users) can install in one tap" — but iCloud already auto-syncs to all your own Apple devices, so that's misleading. The link is only useful for sharing across Apple IDs (fork users, family). Rewrites the intro to acknowledge iCloud auto-sync upfront and re-scopes the table's purpose to cross-Apple-ID sharing only. Adds a forward-pointer to the "Sharing a shortcut with someone else" section near the top of the doc for the placeholder-host trick. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
varunpan
enabled auto-merge (squash)
May 9, 2026 12:57
varunpan
added a commit
that referenced
this pull request
Jun 12, 2026
…ents Root cause (review #16): LubeLoggerError catch arms across six API routes returned upstream topology (endpoint path, upstream status, 200-char upstream body previews) in client responses, and every generic catch arm returned the raw (err as Error).message — internal information disclosure for what should be opaque server errors. Client responses now carry only a generic human-readable message (the UI toasts body.error verbatim, so it must stay meaningful). No detail is lost: LubeLogger failures were already logged at the throw site ('lubelogger non-ok' warn with status + body), and the generic arms now log the full exception at error level before returning. Riding along: FxUnavailableError during a submit now maps to an explicit 503 'enter a manual rate' instead of falling into the raw 500 arm — 5xx (not 4xx) keeps a queued offline replay 'queued' so it retries once FX is obtainable again.
varunpan
added a commit
that referenced
this pull request
Jul 14, 2026
Root cause: the catch arm returned `(err as Error).message` verbatim. For a LubeLoggerError that message embeds the upstream HTTP status and a 200-char preview of the upstream response body — internal detail leaking through an unauthenticated probe endpoint (residual of review finding #16; the fuelup route was fixed then, healthz was missed). Fix shape: the response carries a fixed generic 'upstream unreachable' string, and the real error is logged server-side via locals.logger (the hook binds a per-request child logger on every route, healthz included — only the access-log line is silenced for this path). Same "detail in logs, generic on the wire" posture every other route uses. Tests: healthz test now injects locals; new case proves a secret string in the upstream error body never appears in the 503 response while the 'healthz upstream check failed' warn does reach the logger. Docs: idb-and-api.md healthz 503 row. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168aC5Wm8eTbBDhmfZtNgXG
varunpan
added a commit
that referenced
this pull request
Jul 14, 2026
Root cause: the catch arm returned `(err as Error).message` verbatim. For a LubeLoggerError that message embeds the upstream HTTP status and a 200-char preview of the upstream response body — internal detail leaking through an unauthenticated probe endpoint (residual of review finding #16; the fuelup route was fixed then, healthz was missed). Fix shape: the response carries a fixed generic 'upstream unreachable' string, and the real error is logged server-side via locals.logger (the hook binds a per-request child logger on every route, healthz included — only the access-log line is silenced for this path). Same "detail in logs, generic on the wire" posture every other route uses. Tests: healthz test now injects locals; new case proves a secret string in the upstream error body never appears in the 503 response while the 'healthz upstream check failed' warn does reach the logger. Docs: idb-and-api.md healthz 503 row. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168aC5Wm8eTbBDhmfZtNgXG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drop the misleading 'install in one tap' framing from the Re-publishing iCloud links section — iCloud auto-syncs to your own devices, the link is only useful for sharing across Apple IDs. Rewrites the intro to say so and points at the existing 'Sharing a shortcut with someone else' walkthrough for the placeholder-host trick.
No code changes.
Test plan