patterns: serve the session-explainer template as text/plain

[utsengar]

The bug

Cloudflare Web Analytics appends its beacon to every text/html response at the edge. The session-explainer skeleton was served as text/html, so it came back with a <script> in it.

Found it by accident during the CLI release: an online patterns init wrote a template 359 bytes larger than the repo source. The diff was one line.

$ curl -H 'Accept: */*'       …/session-explainer.template.html | grep -c cloudflareinsights
0
$ curl -H 'Accept: text/html' …/session-explainer.template.html | grep -c cloudflareinsights
1

Only visible when the request signals it wants HTML, which is why it slipped past the existing checks.

Why it matters more for the skeleton than for a page

The skeleton is the one HTML response here that an agent copies rather than renders. So the injected script stops being a transient edge addition and becomes part of the drop body the agent uploads:

• It becomes stored user content. The tag carries a pinned SRI hash and a versioned URL. When Cloudflare rotates the beacon, every baked copy fails integrity and sits there dead.
• Drops built from it carry two beacons — one baked in, one injected per response.
• It contradicts the pattern's own contract. session-explainer.md requires zero <script> tags and its conformance checklist asserts script.length === 0. An agent checking the skeleton it just fetched would fail before writing a line.

The fix

getPatternAsset() serves templates as text/plain; charset=utf-8. Non-HTML responses aren't rewritten — the .md served from the same route was never affected, which is direct evidence from this zone.

A skeleton is source to copy, not a page to render, so text/plain is both the fix and the more honest content type.

Not fixed, on purpose

Edge injection into user drops at /p/:slug/raw is left alone. I raised it and the call was to keep it. CLAUDE.md now records that decision, because the existing Sentry note ("we never inject into user-published drop HTML") reads like it forbids this — that rule is about what the Worker adds, not what the edge does, and a future session shouldn't "fix" it.

Test change

The old assertion checked the response content type, and separately checked the source file for scripts. Both passed while the served response had a script in it. Now it asserts the served bytes, and fetches a second time with Accept: text/html since that's the request shape that triggers injection:

✓ template served as text/plain (blocks HTML rewriting)
✓ template has zero script tags (session-template.html)
✓ template has zero script tags (session-template-htmlaccept.html)
✓ template bytes identical regardless of Accept header

Verification

• npx tsc --noEmit clean
• npm run test:e2e — all 148 checks pass (was 146)
• Will confirm on the preview that Accept: text/html no longer changes the bytes

🤖 Generated with Claude Code

[github-actions]

🚀 Cloudflare preview

URL: https://40b8e61b-htmlbin.utkarsh2012.workers.dev

Built from commit 528c24d968d8db05397f44418ab64b761a151415.

Note: bindings (D1, KV, AI) are shared with production.
Avoid destructive PR tests on real data.