Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.
Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.
Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.
Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Follow-up to the PII-redaction fix, addressing the compliance-swarm findings on this unauthenticated client telemetry sink:
- Per-/24 rate limit (30/min) via checkRateLimit — bounds log-flooding (CC6.1). Fails open when no limiter is configured; the whole handler is wrapped so a transient limiter error degrades to { ok:false } rather than a 500.
- Cap message length (2000) and serialized extra size (8 KB) — bounds client input (V2.2). Shape is coerced rather than strictly schema-rejected, so a malformed report still logs (this endpoint exists to capture client errors).
- No auth added: the endpoint is intentionally called pre-auth during onboarding.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The onboarding client-error endpoint logged untrusted client-supplied message + extra via raw console.error + JSON.stringify(extra) with NO redaction, leaking personnummer / IBAN / tokens into Vercel logs. Route through the structured logger (createLogger), whose REDACT_KEYS + redactString sanitize both the message and the nested extra payload before emit. Response contract unchanged ({ ok: true|false }).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
