Timeline consent says "GitHub records" whatever the source is

[tnunamak]

Timeline is meant to work across PDPP sources, but its consent screen only ever talks about GitHub. src/pages/timeline/index.tsx:199-201:

Timeline will request read access to the GitHub records available from
your local Personal Server.

and L247 labels the stream list Verified GitHub streams. Both are literal strings, shown no matter which source the grant is actually for. A user connecting something else is asked to approve access to records that are not theirs, which is a bad thing to be wrong about on a consent screen.

There is already a helper for this. getPrimaryDataSourceLabel in src/lib/scope-labels.ts derives a readable source name from scopes, and src/hooks/useConnectedApps.ts:19 uses it that way. Derive the label from the normalized authorization details and fall back to something generic when there is no confident answer. Do not guess a source name.

The retention line has the same flavor of problem. src/pages/timeline/index.tsx:273 renders:

{retention.max_duration}; {retention.on_expiry} on expiry.

so users read P30D; delete on expiry. That is an ISO 8601 duration leaking into the interface. Turn day and hour durations into plain language and do the same for the delete and anonymize behaviors. For a value you do not recognize, show it as-is rather than mangling it. An unfamiliar string is better than a confident wrong translation.

Heads up that src/pages/timeline/index.test.tsx asserts the current raw format:

expect(screen.getByText(/P30D; delete on expiry/i)).toBeTruthy()

so you will be updating that test on purpose. Say so in the PR.

This is display only. Do not change the normalized consent terms or the grant request itself.

npm test

I will check a GitHub grant and a non-GitHub grant, plus a made-up retention token, to see that the unknown case stays legible.