Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.
Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.
Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.
Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Closes the two code-side gaps found while auditing the Claude Connectors
Directory submission checklist after #682/#683:
1. Origin-header validation on the /mcp endpoint (POST/GET/DELETE) — an
explicit directory submission requirement and an MCP spec MUST for the
Streamable HTTP transport (DNS-rebinding defense). Requests without an
Origin header (claude.ai backend, Claude Desktop, npx gnubok-mcp,
Claude Code, MCP Inspector's proxy — every known client) pass through
unchanged. A present Origin is allowed only when its host matches the
request Host (covers Vercel previews + self-hosted without hardcoding)
or NEXT_PUBLIC_APP_URL (proxy-rewritten Host); anything else is 403
with a JSON-RPC error envelope. The endpoint sets no CORS headers, so
no currently-working browser flow is affected.
2. serverInfo.title: 'Accounted' (MCP 2025-06-18 display name). name
stays 'gnubok' — stable identifier clients may key state on.
3. export-docs-to-website.mts now also exports CONNECT_CLAUDE_MD to the
gnubok-website repo, so docs.gnubok.se/connect-claude (the target of
the canonical /docs/api redirect) stays in sync. Companion website PR:
jakobwennberg/gnubok-website#1.
Tests: new origin-guard.test.ts (10 tests — no-Origin pass-through,
same-origin, preview host, proxy host via env, foreign/port-mismatch/
null/malformed rejection, 403 envelope, and per-method enforcement on
the registered apiRoutes). Full MCP suite 295/295 green.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
