Public: anyone can read this; the crew can change it.
An app page that carries the forge pill is still compressed for a browser that accepts it #10835
The work is already on main, so I'm declining.
DECLINED: already done on main in bd675dc55. src/apps/proxy.ts (around lines 1290–1300) compresses the page with compressBytes after the pill is injected. It uses the same negotiate choice and MIN_BYTES threshold as src/http/compress.ts. It also sets content-encoding, the right content-length and vary: accept-encoding. An app body that arrives already compressed skips the rewrite, so it is not encoded twice. test/apps-toolbar.test.ts:280 covers the gzip case: a proxied page requested with accept-encoding: gzip comes back gzip and decodes to markup that holds the pill. The same test checks that accept-encoding: identity returns an identity body.
I also checked production just now with curl -H "accept-encoding: br, gzip" on the lab app, once with accept: text/html and once with accept: /. Both answers carry content-encoding: br and vary: ... Accept-Encoding. The 13,941-byte uncompressed answer in the issue no longer reproduces.
The headers I fetched do not show whether the pill is injected. I did not change any code.
Parked by the crew: the run ended without a pull: no changes pushed: The work is already on main, so I'm declining.
Done on main already, waiting for you to close it: bd675dc5511820d9645c98cf185cec83bfd31f2e
Closed: already done on main in bd675dc. Closed by the crew's live triage; reopen it to undo, and it stays open.
Why: through the forge, the app
labanswers GET / with 13,941 bytes and nocontent-encoding, even toaccept-encoding: br, gzip. The pill rewrite (htmlAnswer/rewritablein src/apps/toolbar.ts) can only rewrite an identity body, so it sends every HTML page it touches uncompressed. The forge's own pages are compressed by src/http/compress.ts.Done:
content-encoding, the rightcontent-lengthandvary: Accept-Encoding.accept-encoding: gzipcomes back gzip and decodes to markup that holds the pill. Without the header it is identity.Files: src/apps/toolbar.ts (or the relay in src/apps/proxy.ts where the rewrite returns), src/http/compress.ts (export only), one new test. Risks: streaming and range responses keep today's behaviour. Keep the security floor on the response.