Serve Hesychia crawler files as static text #44

Merged

westfarn merged 3 commits from feat/43-static-crawler-files into master

2026-10-19 08:07:47 -07:00

Author	SHA1	Message	Date
westfarn	5e9878632e	Serve Hesychia pages with 404s and security headers (#45 ) Sync runner checkout / sync (pull_request) Successful in 7s Details ## Summary - Unknown Hesychia URLs return 404 with `404.html` instead of 200 and the app shell. - Extensionless routes (`/legal/terms-of-service`, billing return paths, `/document_storage`) are served as HTML. - `chat_web_app` sends the security headers. The enforcing CSP stays loose enough for Tianji, the API, and the new analytics hosts. A stricter policy is report-only. - Production only: one-character paths redirect for HeyCatch short links. Depends on #44. Merge that first, then retarget this to `master` if Gitea does not do it automatically. ## Test plan - [ ] After #44 and this change are deployed, `curl -sI https://hesychia.ai/not-a-page` is 404. - [ ] `curl -sI https://hesychia.ai/pricing/` is 200 once the frontend shells are published. - [ ] Response headers include `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy`. - [ ] `curl -sI https://hesychia.ai/x` is a 302 to `/?utm_source=heycatch&utm_campaign=x`. Reviewed-on: #45	2026-10-19 08:02:51 -07:00
westfarnandCursor	3174c34a6f	Merge master and keep both the webhook proxy and crawler file locations. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-17 07:20:48 -05:00
westfarnandCursor	dce0879e62	Serve Hesychia crawler files as static text instead of the app shell. Exact locations return robots.txt, sitemap.xml, and llms.txt, or 404. Closes #43. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-17 07:19:05 -05:00

Author

SHA1

Message

Date

westfarn

5e9878632e

Serve Hesychia pages with 404s and security headers (#45 )

Sync runner checkout / sync (pull_request) Successful in 7s

Details

## Summary
- Unknown Hesychia URLs return 404 with `404.html` instead of 200 and the app shell.
- Extensionless routes (`/legal/terms-of-service`, billing return paths, `/document_storage`) are served as HTML.
- `chat_web_app` sends the security headers. The enforcing CSP stays loose enough for Tianji, the API, and the new analytics hosts. A stricter policy is report-only.
- Production only: one-character paths redirect for HeyCatch short links.

Depends on #44. Merge that first, then retarget this to `master` if Gitea does not do it automatically.

## Test plan
- [ ] After #44 and this change are deployed, `curl -sI https://hesychia.ai/not-a-page` is 404.
- [ ] `curl -sI https://hesychia.ai/pricing/` is 200 once the frontend shells are published.
- [ ] Response headers include `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy`.
- [ ] `curl -sI https://hesychia.ai/x` is a 302 to `/?utm_source=heycatch&utm_campaign=x`.

Reviewed-on: #45

2026-10-19 08:02:51 -07:00

westfarnandCursor

3174c34a6f

Merge master and keep both the webhook proxy and crawler file locations.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-17 07:20:48 -05:00

westfarnandCursor

dce0879e62

Serve Hesychia crawler files as static text instead of the app shell.

Exact locations return robots.txt, sitemap.xml, and llms.txt, or 404.
Closes #43.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-17 07:19:05 -05:00