Serve /nav-agent/* static assets — raw http routed index/drill.js but not the nav-agent drop-in, so /nav-agent/* 404'd; add traversal-guarded route

d0de55395ca14e3ab568a4bd7b7453b3a3ea9d8b · 2026-08-13 14:08:38 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit d0de55395ca14e3ab568a4bd7b7453b3a3ea9d8b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 13 14:08:38 2026 -0700

    Serve /nav-agent/* static assets — raw http routed index/drill.js but not the nav-agent drop-in, so /nav-agent/* 404'd; add traversal-guarded route
---
 server.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/server.js b/server.js
index 39ae758..3dc76a4 100644
--- a/server.js
+++ b/server.js
@@ -494,6 +494,15 @@ const server = http.createServer((req, res) => {
       try { return send(res, 200, fs.readFileSync(path.join(__dirname, 'public', 'drill.js')), 'text/javascript; charset=utf-8'); }
       catch { return send(res, 404, '// not found', 'text/javascript'); }
     }
+    if (u.pathname.startsWith('/nav-agent/')) {
+      // universal grid-controls drop-in (nav-agent.js/.css) — traversal-guarded static
+      const PUB = path.join(__dirname, 'public');
+      const fp = path.normalize(path.join(PUB, decodeURIComponent(u.pathname)));
+      if (fp.startsWith(PUB + path.sep) && fs.existsSync(fp) && fs.statSync(fp).isFile()) {
+        return send(res, 200, fs.readFileSync(fp), fp.endsWith('.css') ? 'text/css; charset=utf-8' : 'text/javascript; charset=utf-8');
+      }
+      return send(res, 404, '// not found', 'text/javascript');
+    }
     if (u.pathname === '/img') { serveImg(u.searchParams.get('u') || '', res); return; }
     if (u.pathname === '/api/similar') {
       const sku = u.searchParams.get('sku');

← a665308 nav-agent: universal grid-controls drop-in on internal viewe · back to New Import Viewer · chore: v1.1.1 (nav-agent static-serving fix, session close) f03b673 →