westfarn
5e9878632e
Sync runner checkout / sync (pull_request) Successful in 7s
## Summary - Unknown Hesychia URLs return 404 with `404.html` instead of 200 and the app shell. - Extensionless routes (`/legal/terms-of-service`, billing return paths, `/document_storage`) are served as HTML. - `chat_web_app` sends the security headers. The enforcing CSP stays loose enough for Tianji, the API, and the new analytics hosts. A stricter policy is report-only. - Production only: one-character paths redirect for HeyCatch short links. Depends on #44. Merge that first, then retarget this to `master` if Gitea does not do it automatically. ## Test plan - [ ] After #44 and this change are deployed, `curl -sI https://hesychia.ai/not-a-page` is 404. - [ ] `curl -sI https://hesychia.ai/pricing/` is 200 once the frontend shells are published. - [ ] Response headers include `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy`. - [ ] `curl -sI https://hesychia.ai/x` is a 302 to `/?utm_source=heycatch&utm_campaign=x`. Reviewed-on: #45