Skip to content

fix(app): declare utf-8 on text responses - #10492

Merged
MarkusNeusinger merged 2 commits into
mainfrom
fix/nginx-charset
Aug 19, 2026
Merged

fix(app): declare utf-8 on text responses#10492
MarkusNeusinger merged 2 commits into
mainfrom
fix/nginx-charset

Conversation

@MarkusNeusinger

Copy link
Copy Markdown
Owner

Summary

  • llms.txt and robots.txt carry UTF-8 punctuation (em dashes, arrows) but were served as bare text/plain without a charset — a strict client decodes them as Latin-1 mojibake (found by the machine-files verifier in the 2026-08-19 live sweep; llms-full.txt, generated by the API, already declares charset=utf-8).
  • charset utf-8; in both nginx server blocks (main + python.anyplot.ai). It applies to nginx's default charset_types; proxied responses that already declare a charset keep theirs.
  • The daily bot-serving monitor now asserts the charset on llms.txt (timeout comment recomputed: 22 retried checks + two non-retried probes).

Plan

One of the three "for later" items from the AI-access verification sweep, done on request. Independent of #10490 and #10491.

Test plan

  • Config-only change following the existing block structure; no local nginx syntax check possible here (no docker) — same known verification gap as fix(app): reach the AI clients the UA gate and empty shell were losing #10488, flagged per CLAUDE.md
  • After merge + deploy: curl -sI https://anyplot.ai/llms.txt | grep -i content-typetext/plain; charset=utf-8; same for robots.txt; the extended daily monitor guards it from then on

llms.txt and robots.txt carry em dashes and arrows but were served as
bare text/plain (live-verification sweep 2026-08-19) - a strict client
decodes them as Latin-1 mojibake. charset utf-8 in both server blocks;
the daily bot-serving monitor asserts it on llms.txt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings August 19, 2026 20:04
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR ensures static machine-facing text files are served with an explicit UTF-8 charset so strict clients decode llms.txt / robots.txt correctly (avoiding Latin‑1 mojibake), and extends the daily bot-serving monitor to enforce that contract going forward.

Changes:

  • Add charset utf-8; to both nginx server blocks so text/plain responses include charset=utf-8.
  • Extend the daily bot-serving GitHub Actions workflow to assert llms.txt’s Content-Type includes charset=utf-8.
  • Add a corresponding [Unreleased] changelog entry describing the fix.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
CHANGELOG.md Documents the UTF-8 charset fix under [Unreleased].
app/nginx.conf Declares charset utf-8; in both nginx server blocks to ensure text responses include a UTF-8 charset.
.github/workflows/bot-serving-check.yml Adds a monitor assertion that llms.txt is served with charset=utf-8 and updates the timeout commentary accordingly.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@codecov

codecov Bot commented Aug 19, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@MarkusNeusinger
MarkusNeusinger merged commit 31845f5 into main Aug 19, 2026
9 checks passed
@MarkusNeusinger
MarkusNeusinger deleted the fix/nginx-charset branch August 19, 2026 20:37
MarkusNeusinger added a commit that referenced this pull request Aug 19, 2026
## Summary
- Documents the `anyplot-images` IAM change applied 2026-08-19:
`allUsers` swapped from `roles/storage.objectViewer` (bundles
`storage.objects.list` — the whole bucket, including the unreviewed
`staging/` prefix, was publicly enumerable) to
`roles/storage.legacyObjectReader` (get-only). Verified live: every
render URL still 200 incl. CORS; both listing APIs now denied
(401/AccessDenied).
- The runbook entry sits next to the bucket CORS section in
`agentic/docs/project-guide.md` with the re-apply command — bucket IAM
does not deploy with the repo, so a rebuild would silently drop it.
Changelog entry included.

## Plan
Docs-only. The commit raced #10492's squash-merge (same recovery as
before: cherry-picked onto merged main, stale branch deleted).

## Test plan
- [x] Live verification already done: object GET 200
(light/dark/webp/R/Julia), JSON + XML listing denied,
`access-control-allow-origin: *` intact, `allUsers` holds only
`legacyObjectReader`

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants