feat(devkit): request log + copy-as-curl — see what the app says to the API (claude-todo/10 ⌨️) - #137
Conversation
DevKit was already a draggable panel wired to useApi + Lopu; it now shows what the app is actually saying to the API. A client-side ring buffer (apiRequestLog.ts, capped at 20) records every call from both request paths — getJson (all GETs) and useAsyncFetcher.submit (all mutations) — with method, path, status (0 for network failure), and duration. The DevKit panel gains a "Requests · tap to copy curl" section: newest-first rows with color-coded status + ms, tap → a ready-to-paste curl in the exact style the API docs generate (method, quoted URL, Content-Type + --data when a body exists). Security posture: bodies are redacted before storage — values under keys matching pass/token/secret/code/challenge/apikey become '•••' (the log records login calls, after all), so a copied curl never carries credentials. The session cookie is httpOnly (unreadable from JS by design), so the curl ships a -b 'tt_session=<your session cookie>' placeholder with a toast note. Recording is telemetry-only: every failure path swallows, a broken subscriber can never break a request. 5 unit tests (ring cap + ordering, subscribe/unsubscribe, nested redaction, stored-body redaction, curl shapes incl. single-quote escaping) under a new test:hooks script. Verified live on the worktree dev server: the panel listed real GET rows (status 200, timings) and a real POST /algorithms/track row from the page's own engagement flush; tapping a row produced the curl (the headless pane blocks clipboard, so the graceful fallback toast showed it — the writeText path is the same one the theme gallery uses); mobile 375px renders the section with no horizontal overflow; no console errors. Drive-by surfaced by the new log itself: reactions-recent polls continuously at ~2s per call — flagged as a follow-up task. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 36690589 | Triggered | Generic Password | 170d19b | remix/app/hooks/apiRequestLog.test.ts | View secret |
| 35021280 | Triggered | Username Password | 571b14b | remix/app/hooks/apiRequestLog.test.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
…credential pair GitGuardian flagged the redaction test's fake password (the test that proves passwords get redacted). The keys are what matter — values are now computed at runtime, so no username/password literal pair exists in source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Conflicted paths: remix/package.json Resolved by the resolve-pr-conflicts workflow: https://github.com/lopugit/thingtime/actions/runs/31153996937 Co-Authored-By: Claude <noreply@anthropic.com>
|
🤝 Merged Conflicted files:
Please review the merge commit before relying on it. |
github-actions
Bot
added
the
ai-rebase-in-progress
github-actions
Bot
added
ai-rebase-paused
|
|
|
🤖 Auto-resolve running — the conflict resolver started working on this PR at 08:47 UTC. Expected to finish around 08:55 UTC (resolutions typically land in 3-8 minutes; the job times out at 30). On success a merge commit resolving the conflicts is pushed to this branch and a result comment follows — no manual action is needed meanwhile. |
github-actions
Bot
removed
the
ai-rebase-paused
Conflicted paths: remix/app/api/utils/rateLimit/config.ts, remix/app/hooks/useApi.tsx, remix/app/hooks/useAsyncFetcher.tsx, remix/package.json Resolved by the resolve-pr-conflicts workflow: https://github.com/lopugit/thingtime/actions/runs/31303931936 Co-Authored-By: Claude <noreply@anthropic.com>
|
🤝 Merged Conflicted files:
Please review the merge commit before relying on it. |
github-actions
Bot
added
the
ai-rebase-in-progress
|
🤖 Auto-rebase running — the stack rebase started working on this PR at 08:55 UTC. Expected to finish around 09:10 UTC (rebases typically land in 5-15 minutes; the job times out at 55). On success this branch is force-pushed onto its new base and a result comment follows — no manual action is needed meanwhile. |
github-actions
Bot
added
ai-rebase-paused
|
|
lopugit
added
ai-merge-paused
🤖 Lopu live PR updateStatus: ↪️ Resolver finished; a newer conflict remains Current phase: The next detector event will own the current branch state Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 11:42 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 11:52 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu live PR updateStatus: Current phase: The detailed Lopu result explains the stopped phase Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
|
Residual conflicted files:
|
|
Residual conflicted files:
|
|
Residual conflicted files:
|
🤖 Lopu live PR updateStatus: ↪️ Resolver finished; a newer conflict remains Current phase: The next detector event will own the current branch state Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
|
Residual conflicted files:
|
|
Residual conflicted files:
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 04:28 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 04:36 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu live PR updateStatus: ↪️ Resolver finished; a newer conflict remains Current phase: The next detector event will own the current branch state Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 04:57 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 05:32 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu live PR updateStatus: ↪️ Resolver finished; a newer conflict remains Current phase: The next detector event will own the current branch state Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 05:42 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu live PR updateStatus: ↪️ Resolver finished; a newer conflict remains Current phase: The next detector event will own the current branch state Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
🤖 Lopu live PR updateStatus: 🕒 Resolver queued Current phase: Waiting in Lopu's serialized PR-management lane Estimated completion: around 07:18 UTC (~20 minutes; adjusted as work moves). Next automatic check-in: within 10 minutes, or sooner when the phase changes. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
🤖 Lopu live PR updateStatus: Current phase: The detailed Lopu result explains the stopped phase Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
|
Residual conflicted files:
|
🤖 Lopu live PR updateStatus: ↪️ Resolver finished; a newer conflict remains Current phase: The next detector event will own the current branch state Estimated completion: Done — no further active-work ETA. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
Technical run details — optional; this comment is the human-facing source of truth. |
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 10:32 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 10:41 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 10:48 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 10:56 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 11:09 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 11:21 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
🤖 Lopu detected merge conflictsStatus: Work detected — Lopu is taking ownership. Current phase: Entering Lopu's serialized PR-resolution queue. Estimated completion: around 12:04 UTC (~20 minutes; this adjusts as the queue moves). Next automatic check-in: within 10 minutes while work remains active. You can stay on this PR; there is no need to find the Actions run. Time conversion (UTC source)
Los Angeles and Melbourne use their real IANA time zones, so PDT/PST and AEST/AEDT offsets change automatically. Lopu queue and PR pulse
Related PR context
Exact branch pair: Timeline
|
2 participants
Summary
Implements the DevKit request log + copy-as-curl from claude-todo/10 ⌨️ (session 4's ninth claim; no other branch/PR touches it). DevKit now shows what the app is actually saying to the API.
How it works
getJson(all GETs) anduseAsyncFetcher.submit(all mutations) — recording method, path, status (0= network failure), and duration. Telemetry-only: every failure path swallows; a broken subscriber can never break a request.useSyncExternalStore), tap → a ready-to-paste curl in the exact docs-example style (method, quoted URL,Content-Type+--datawhen a body exists), copied with a Lopu confirm (graceful fallback shows the curl when clipboard is blocked).Security posture
pass|token|secret|code|challenge|apikeybecome•••(the log records login calls, after all), so a copied curl never carries credentials.-b 'tt_session=<your session cookie>'as a placeholder, with the toast explaining where to get it.Tests
5 unit tests (ring cap + newest-first ordering, subscribe/unsubscribe, nested redaction, stored-body redaction, curl shapes incl. single-quote shell escaping) under a new
test:hooksscript.Verification (live, worktree dev server)
/things/reactions-recent· 200 · timings) and a realPOST /algorithms/track 200 · 17msfrom the page's own engagement flush — both instrumentation paths proven live.writeTextpath is the same code the theme gallery's copy-link uses).Drive-by finding (surfaced by the log itself 🎯)
GET /api/v1/things/reactions-recentpolls continuously at ~2000ms per call locally — the very first thing the new log made visible. Flagged as a follow-up task chip.Conflict note
useApi.tsxis touched by my #131/#133/#134 (each adds one client method in different blocks — trivial);package.jsonadds one script line (same block as #130/#135 — trivial).🤖 Generated with Claude Code