From 7a13c5457bb5df7cfecd4a489f7ad8e8830d9254 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Sun, 22 Mar 2026 20:55:02 +0900 Subject: [PATCH 01/13] fix: serve directory index.html for extensionless paths Paths like /stories, /latest, /perspectives returned 404 because the HTML-serving middleware only tried {path}.html, not {path}/index.html. Since express.static has index:false (for custom homepage routing per hostname), directory index files were never served. Add a fallback: when {path}.html doesn't exist for an extensionless path, try {path}/index.html before falling through to next(). Co-Authored-By: Claude Opus 4.6 (1M context) --- server/src/http.ts | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/server/src/http.ts b/server/src/http.ts index 50a2f29d69..7022337b6c 100644 --- a/server/src/http.ts +++ b/server/src/http.ts @@ -722,8 +722,16 @@ export class HTTPServer { } try { - // Check if file exists - await fs.access(filePath); + // Check if file exists; for extensionless paths, also try /index.html + try { + await fs.access(filePath); + } catch { + if (urlPath.endsWith('.html')) { + throw new Error('not found'); + } + filePath = path.join(publicPath, urlPath, 'index.html'); + await fs.access(filePath); + } // Cross-domain session bridge: if on AdCP without a session cookie, // redirect through AAO to pick up the session (if one exists). From d856421bdda31bd9fd1d1ecced4d4c7291175313 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Sun, 22 Mar 2026 20:58:23 +0900 Subject: [PATCH 02/13] add empty changeset Co-Authored-By: Claude Opus 4.6 (1M context) --- .changeset/some-dingos-peel.md | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .changeset/some-dingos-peel.md diff --git a/.changeset/some-dingos-peel.md b/.changeset/some-dingos-peel.md new file mode 100644 index 0000000000..a845151cc8 --- /dev/null +++ b/.changeset/some-dingos-peel.md @@ -0,0 +1,2 @@ +--- +--- From 9ed59aa84251ba6ab2b8663a3ced7ee41bbdaeee Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Sun, 22 Mar 2026 21:03:50 +0900 Subject: [PATCH 03/13] fix: eliminate TOCTOU race flagged by CodeQL Replace fs.access + fs.readFile with direct fs.readFile, catching errors to try fallback paths. Removes the file-system-race alert (js/file-system-race). Co-Authored-By: Claude Opus 4.6 (1M context) --- server/src/http.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/server/src/http.ts b/server/src/http.ts index 7022337b6c..9192c3fe75 100644 --- a/server/src/http.ts +++ b/server/src/http.ts @@ -722,15 +722,16 @@ export class HTTPServer { } try { - // Check if file exists; for extensionless paths, also try /index.html + // Read HTML file directly; for extensionless paths, also try /index.html + let html: string; try { - await fs.access(filePath); + html = await fs.readFile(filePath, 'utf-8'); } catch { if (urlPath.endsWith('.html')) { throw new Error('not found'); } filePath = path.join(publicPath, urlPath, 'index.html'); - await fs.access(filePath); + html = await fs.readFile(filePath, 'utf-8'); } // Cross-domain session bridge: if on AdCP without a session cookie, @@ -741,8 +742,7 @@ export class HTTPServer { const user = await getUserFromRequest(req, res); await enrichUserWithMembership(user); - // Read and inject config - let html = await fs.readFile(filePath, 'utf-8'); + // Inject config const configScript = getAppConfigScript(user); // Inject before From b6e8f0753e6f86dce063caf3866c3fd52e8f3dad Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Mon, 23 Mar 2026 05:41:49 +0900 Subject: [PATCH 04/13] fix: restore nav changes lost in PR #1600 merge conflict The merge commit for PR #1600 dropped most nav.js changes during conflict resolution. Only the "Edit profile" link survived. This restores: Stories nav link, founding member banner, account avatar, nav restructure (Registry moved right), mobile menu updates, footer link updates, and associated CSS/JS. Co-Authored-By: Claude Opus 4.6 (1M context) --- server/public/nav.js | 171 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 163 insertions(+), 8 deletions(-) diff --git a/server/public/nav.js b/server/public/nav.js index 74ab5bcfe1..750a438139 100644 --- a/server/public/nav.js +++ b/server/public/nav.js @@ -103,6 +103,7 @@ + + ` : ''; + return ` -