feat(starsofdesign): bring Big Red back — widget tag + CSP whitelist for :9935

6f7c2ddacac0f037203c80b109b5d54021fe3795 · 2026-05-12 12:00:09 -0700 · Steve Abrams

Big Red avatar launcher was missing from StarsOfDesign + AsSeenInMovies
even though the big-red server at :9935 was up and healthy. Earlier
embed work only touched corkwallcovering + factory-floor.

views/partials/footer.ejs — adds the <script src=:9935/widget.js> tag
in retail mode before </body>. Widget self-mounts to body as a fixed
lower-right launcher; goes green when chat is live.

server.js helmet CSP — whitelists http://localhost:9935 + ws://localhost:9935
across script-src, img-src (avatar), connect-src (fetch + WebSocket),
and frame-src (chat iframe). Drops these entries when the named tunnel
bigred.agentabrams.com goes live.

Files touched

M server.js
M views/partials/footer.ejs

Diff

commit 6f7c2ddacac0f037203c80b109b5d54021fe3795
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 12 12:00:09 2026 -0700

    feat(starsofdesign): bring Big Red back — widget tag + CSP whitelist for :9935
    
    Big Red avatar launcher was missing from StarsOfDesign + AsSeenInMovies
    even though the big-red server at :9935 was up and healthy. Earlier
    embed work only touched corkwallcovering + factory-floor.
    
    views/partials/footer.ejs — adds the <script src=:9935/widget.js> tag
    in retail mode before </body>. Widget self-mounts to body as a fixed
    lower-right launcher; goes green when chat is live.
    
    server.js helmet CSP — whitelists http://localhost:9935 + ws://localhost:9935
    across script-src, img-src (avatar), connect-src (fetch + WebSocket),
    and frame-src (chat iframe). Drops these entries when the named tunnel
    bigred.agentabrams.com goes live.
---
 server.js                 | 11 ++++++++---
 views/partials/footer.ejs |  7 +++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index 186209c..d665f1b 100644
--- a/server.js
+++ b/server.js
@@ -24,11 +24,16 @@ app.use(helmet({
   contentSecurityPolicy: {
     directives: {
       defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-inline'", 'https://www.googletagmanager.com', 'https://www.google-analytics.com'],
+      // http://localhost:9935 is the Big Red widget host (lower-right avatar
+      // launcher on every page); its iframe + JS + fetch traffic must be
+      // allowed here. Drop the localhost:9935 entries when the named
+      // tunnel bigred.agentabrams.com goes live.
+      scriptSrc: ["'self'", "'unsafe-inline'", 'http://localhost:9935', 'https://www.googletagmanager.com', 'https://www.google-analytics.com'],
       styleSrc:  ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
-      imgSrc:    ["'self'", 'data:', 'https:'],
+      imgSrc:    ["'self'", 'data:', 'https:', 'http://localhost:9935'],
       fontSrc:   ["'self'", 'https://fonts.gstatic.com', 'data:'],
-      connectSrc: ["'self'", 'https://www.google-analytics.com', 'https://*.analytics.google.com', 'https://*.googletagmanager.com'],
+      connectSrc: ["'self'", 'http://localhost:9935', 'ws://localhost:9935', 'https://www.google-analytics.com', 'https://*.analytics.google.com', 'https://*.googletagmanager.com'],
+      frameSrc:  ["'self'", 'http://localhost:9935'],
       frameAncestors: ["'none'"],
       objectSrc: ["'none'"],
       baseUri:   ["'self'"],
diff --git a/views/partials/footer.ejs b/views/partials/footer.ejs
index 4dd112b..047a5c9 100644
--- a/views/partials/footer.ejs
+++ b/views/partials/footer.ejs
@@ -37,5 +37,12 @@
     <span class="muted">Editorial profiles for reference only. Stars of Design is independent of the designers and brands named on these pages.</span>
   </div>
 </footer>
+
+<!-- Big Red — lower-right avatar launcher (red ring closed → green when chat is live).
+     Source served by ~/Projects/big-red on :9935; widget self-mounts to <body>. -->
+<script src="http://localhost:9935/widget.js"
+        data-host="http://localhost:9935"
+        data-mode="retail"
+        defer onerror="this.remove()"></script>
 </body>
 </html>

← da8a343 feat(starsofdesign/deep-recon-v2): --windows={v1|v2|all} for · back to Stars of Design · feat(starsofdesign): expand top-us-firms seed +39 (arch 39, ddd574f →