Repository navigation
docs(terms): the signed commercial terms as drafts; the plans page lists the ways to buy - #28
Merged
Merged
Conversation
…rrect the bot-detection sentence PRIVACY.md now says the site uses Cloudflare Web Analytics, which counts visits with no cookie and gives only aggregate statistics (page, referrer, country, browser) that identify no one, and that an ad-blocker can make the counts run low. The sentence saying Cloudflare injects a bot-detection script is replaced: the zone's JavaScript Detections were switched off on 2026-10-07, re-measured with curl, so "no cookies at all" is true again. A note records that Bot Fight Mode or Turnstile, if ever switched on, would set Cloudflare's security cookies and force a rewording. A short Age section gives the 18-or-local-consent-age formula, a neutral confirmation at sign-up, no identity image kept, and the unused-part refund when an account is disabled. All of it is labelled pending legal review, in English and Thai. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… a dormant Thai cancellation clause TERMS.md (still a draft, unlinked) now carries the age rule, output ownership with opt-in-only training, Thai law and courts with consumer rights preserved, the liability cap, the refund floor and the refund of the unused part on a no-fault end, 30 days' notice of a change, and the key limits and expiry. The acceptable-use section gives the due-process ladder (notice, suspension, a window to answer, a written decision, one appeal, a register) and the chargeback track on Paddle's side; the day counts and the appeal channel stay placeholders. The Thai 7-day clause is written in English and Thai as dormant, with its trigger named and the current refund rule stated as the live one. Every clause sent to counsel carries the pending-legal-review marker; the list of prohibited conduct and the licence for downloadable weights are named as open. CHANGELOG records the three document changes under Unreleased. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…city ratios Under the price grid, in English and Thai: the subscription (monthly or yearly, a first-period refund deducts the days used), the prepaid time key (7, 30, 90 or 365 days, equal to the same plan for that many days; adds time up to 36 months; an unredeemed key is refundable in full within 14 days and expires 12 months after purchase; 2 per order and 4 per account per sale window or rolling 30 days; non-transferable, bound to the account on activation) and the prepaid usage credits (Kolwen's own service only, no transfer, no cash-out, unused credits refundable at the price paid within 14 days; whether they expire is stated as not yet decided). The capacity axis is named as token quota with the ratios 0.4x / 1x / 5x / 10x of Standard and no quota amount. "Nothing here can be bought yet" stays and every buy button stays disabled. The CSP swaps the plans page's style hash for its new bytes; rules 15 to 17 pass unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… source at 313704e Both files are byte-for-byte copies of the private repository's origin/main blobs at that commit (git hash-object: scripts/lib/secret-scan.mjs 270a21a, scripts/secret-scan.test.mjs bd5b156), so the three copies of the scanner agree again. The scanner tests, the secret-gate tests and the secret gate pass against the new copy. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…i cancellation clause, and log the plans and scanner changes web/plans.html (English and Thai) now says the purchase terms are a draft pending legal review, and the refund and transfer lines carry the house label. Body text only; no style or script byte changed. In TERMS.md the Thai twin of the dormant 7-day clause now names the Act and limits the right to a business that sells directly or through direct marketing, and its second trigger reads direct-marketing registration only, matching the English. CHANGELOG lists the Ways to buy card with the capacity ratios and the scanner re-copy. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
📝 WalkthroughWalkthroughThe pull request adds draft purchase options and commercial terms, updates privacy disclosures, and changes secret-scanning rules and tests. It also updates the plans page’s content security policy style hash. ChangesPurchase and policy disclosures
Secret scanner updates
Priority: ➖ Normal Estimated code review effort: 4 (Complex) | ~45 minutes Change: Other Merge Risk: ⚪ Minimal · up to No issue identified in the supplied changes prevents merging after normal checks.
Comment |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| const RAND264 = 'q7Rt2Lk9' + 'Xw4Zp1Mn8Vb3Yc6Dd5Ff0Gg'; // a 30-character random base62 literal | ||
|
|
||
| test('a .NET ResX file reference: the closing </value> tag is not part of the public key token before it', () => { | ||
| const head = '<value>..' + '\\Resources\\icon.png;System.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, Public' + 'KeyToken='; |
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://lwk2-ar-docs-kolwen.hetcreep.workers.dev (commit eabc6fe)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const RAND264 = 'q7Rt2Lk9' + 'Xw4Zp1Mn8Vb3Yc6Dd5Ff0Gg'; // a 30-character random base62 literal | ||
|
|
||
| test('a .NET ResX file reference: the closing </value> tag is not part of the public key token before it', () => { | ||
| const head = '<value>..' + '\\Resources\\icon.png;System.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, Public' + 'KeyToken='; |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Organization UI
- Review profile: CHILL
- Plan: Essentials
- Run ID:
127a91f0-f0b8-4c39-bad4-540e68652649
📒 Files selected for processing (7)
CHANGELOG.mdPRIVACY.mdTERMS.mdscripts/lib/secret-scan.mjsscripts/secret-scan.test.mjsweb/_headersweb/plans.html
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Workers Builds: kolwen
🧰 Additional context used
📓 Path-based instructions (9)
This file is a copy of org-canon code that every carrier keeps byte-identical.
⚙️ CodeRabbit configuration file
Files:
scripts/lib/secret-scan.mjsscripts/secret-scan.test.mjs
Kolwen's page served from Cloudflare Workers, and its deploy-kit master in .github.
⚙️ CodeRabbit configuration file
Files:
web/_headersweb/plans.html
A claim about behaviour must match what the code actually does, and any data shown (a version, a model ID, a benchmark figure, a count) must match its authoritative source verbatim.
⚙️ CodeRabbit configuration file
Files:
PRIVACY.mdTERMS.md
Tests use node:test only, run from an explicit file list that fails on an unlisted or missing file.
⚙️ CodeRabbit configuration file
Files:
scripts/secret-scan.test.mjs
Keep a Changelog.
⚙️ CodeRabbit configuration file
Files:
CHANGELOG.md
Library modules, and some ship to users.
⚙️ CodeRabbit configuration file
Files:
scripts/lib/secret-scan.mjs
Repo gates and CLIs.
⚙️ CodeRabbit configuration file
Files:
scripts/lib/secret-scan.mjsscripts/secret-scan.test.mjs
House style is the UNSPACED em dash, an owner ruling, so do not suggest spaced dashes.
⚙️ CodeRabbit configuration file
Files:
CHANGELOG.mdPRIVACY.mdTERMS.md
Context for every file.
⚙️ CodeRabbit configuration file
Files:
web/_headersweb/plans.htmlCHANGELOG.mdPRIVACY.mdscripts/lib/secret-scan.mjsscripts/secret-scan.test.mjsTERMS.md
🪛 GitHub Check: CodeQL
scripts/secret-scan.test.mjs
[warning] 77-77: Missing space in string concatenation
This string appears to be missing a space after 'Public'.
🔇 Additional comments (7)
scripts/lib/secret-scan.mjs (1)
84-91: LGTM!Also applies to: 151-201, 217-244, 267-272
scripts/secret-scan.test.mjs (2)
69-102: LGTM!
104-300: LGTM!Also applies to: 397-474, 517-572, 663-668
TERMS.md (1)
6-10: LGTM!Also applies to: 22-24, 33-52, 54-65, 67-90, 92-107, 109-127, 128-146, 148-172, 174-205
web/plans.html (1)
34-34: LGTM!Also applies to: 92-105, 110-110, 146-159, 164-164
web/_headers (1)
101-101: LGTM!PRIVACY.md (1)
104-105: 🔒 Security & PrivacyDisclose the performance metrics collected by Web Analytics.
If the deployed Cloudflare Web Analytics integration uses its performance beacon, update this paragraph to include the page-load timing and Core Web Vitals data that the beacon sends. Otherwise, describe the actual analytics integration and its collected data.
The note on what could end the "no cookies at all" sentence now follows Cloudflare's own cookie and clearance pages: Bot Fight Mode sets the __cf_bm cookie, and Turnstile sets cf_clearance only when its pre-clearance option is enabled. Either one would make the sentence need rewording. The earlier wording said both settings set both cookies. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
TERMS.mdcarries the signed commercial terms as a draft:TERMS.md.PRIVACY.mdnames the aggregate, cookie-less analytics and adds the age line.web/plans.htmlgains a "Ways to buy" list: subscription, prepaid time key and prepaid credits, with their rules. The capacity axis is stated as a token quota at 0.4x, 1x, 5x and 10x of Standard, with no quota number. A line says the purchase terms are a draft pending legal review, in English and Thai. Buy buttons stay disabled.scripts/lib/secret-scan.mjsand its test are re-copied byte-for-byte from the canonical source.Proof
🤖 Generated with Claude Code
Summary by CodeRabbit