feat(coil): a real link-preview card for shared URLs by radroid · Pull Request #84 · radroid/t3code

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid · 2026-08-11T14:24:42Z

Sharing coil.curlycloud.dev on WhatsApp or social produced a poor card. Three causes, all in the markup:

	Before	After
`og:image`	`/icon.png` — 1024×1024 square, 1.1 MB	`/og.png` — 1200×630, 74 KB
`twitter:card`	`summary` (small square)	`summary_large_image` (banner)
`description`	pre-repositioning copy	matches the current page
dimensions	absent	`og:image:width/height/type/alt`

A square at 1.1 MB is the worst case for an unfurler: it renders as a small thumbnail rather than a banner, and that size is past the point where several of them quietly give up. The explicit dimensions matter because WhatsApp reads them from the markup to pick a layout before it fetches the image.

The card

Rendered from the new scripts/og-card.html rather than hand-drawn, so it cannot drift from the site — every colour, font and string in it is the same token or copy the page already uses.

No pnpm run og script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. Regeneration steps live in the HTML's own comment.

Verified on the deployed site

All tags render with absolute URLs (unfurlers do not resolve relative paths)
/og.png → 200, PNG image data, 1200 x 630
The 404 page inherits the same tags

Correction to what I said earlier about the 403

I previously reported that Cloudflare bot mitigation blocks all datacenter traffic, and therefore that link previews were definitely broken. Re-testing shows that is too strong:

Client	Result
Bare HTTP client from datacenter (GitHub runner curl, plain fetcher)	403
Headless-browser service from datacenter	200
Residential browser	200

So it discriminates on client fingerprint, not on datacenter IPs wholesale. Whether WhatsApp specifically gets through depends on Cloudflare's verified-bot allowlist, which cannot be tested from here — spoofing the user agent does not reproduce it, because Cloudflare validates verified bots by IP ownership. The definitive test is sharing the link. Everything else that could have broken the card is now fixed.

🤖 Generated with Claude Code

Sharing coil.curlycloud.dev produced a poor card, for three reasons that were all in the markup rather than anything exotic: - og:image pointed at /icon.png — a 1024x1024, 1.1 MB square. Unfurlers render a square as a small thumbnail rather than a banner, and that file size is past the point where several of them quietly give up. - twitter:card was `summary`, which is the small square layout by definition. - The description still described the pre-repositioning page ("auto-updates, push notifications, and a daily upstream sync"). Adds a purpose-built 1200x630 card at ~74 KB, rendered from the new scripts/og-card.html so it cannot drift from the site — every colour, font and piece of copy in it is the same token or string the page uses. Also publishes og:image:width/height/type/alt, which is what WhatsApp reads to decide between the banner and thumbnail layouts before it fetches anything. No `pnpm run og` script on purpose: Playwright is not a dependency here, and adding a browser to regenerate a file that changes twice a year would put ~500 lines into pnpm-lock.yaml, the fork's second-worst rebase-conflict surface. The regeneration steps are in the HTML's own comment. Verified on the deployed site: all tags render with absolute URLs, /og.png serves 200 as a 1200x630 PNG, and the 404 page inherits the same tags.

coderabbitai · 2026-08-11T14:24:53Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4ebe3f3f-b6b7-47a4-aa3e-afdf49a306e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Both landed on main after this branch was cut, and both added files under the directories it moves. Two were live breaks rather than cosmetics: - apps/coil-home/src/lib/install.ts imported the install-instructions JSON by relative path through scripts/t3x/, which no longer exists. - index.astro derived the upstream version by splitting the manifest on "-t3x". It now splits on either suffix, because the relay serves whatever the LAST release published and a -t3x manifest stays current right up until the first coil build. Splitting on only the new one would have rendered "0.0.33-t3x.26" where "0.0.33" belongs. The release workflow's inline body was replaced by #78's generated one, so the app-name edit this branch made there now belongs to install-instructions.json instead, which carries it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

radroid merged commit e44bf26 into mainAug 12, 2026
2 checks passed

radroid deleted the t3x/coil-og-card branch August 12, 2026 02:51