From 3903ac98bed46e38304fff61017a938889b33b3e Mon Sep 17 00:00:00 2001
From: Ivan Cheung <ivanmkc@google.com>
Date: Tue, 16 Jun 2026 19:12:21 +0000
Subject: [PATCH] fix(viewer): redirect /w/<wsid> to /w/<wsid>/ so assets load
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A workspace URL without the trailing slash (e.g. /w/345926bf020d1034) rendered
a blank "connecting…" page. index.html references its assets relatively
(<script src="viewer.js">), so without the slash the browser resolves them
against /w/ — fetching /w/viewer.js, which the SPA fallback answers with HTML.
The browser then refuses the module (MIME "text/html"), so the client script
never loads: status stuck "connecting…", no boards, blank canvas.

The /s/<token> share path already redirects the bare form to add the slash;
the /w/<wsid> path was missing the same guard. Add it (preserving any query;
the URL fragment is carried across a fragment-less redirect by the browser).
---
 packages/viewer/src/server.ts              | 10 ++++++++++
 packages/viewer/test/server-static.test.ts | 17 +++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/packages/viewer/src/server.ts b/packages/viewer/src/server.ts
index 2d4495d..97d4ed0 100644
--- a/packages/viewer/src/server.ts
+++ b/packages/viewer/src/server.ts
@@ -374,6 +374,16 @@ export function createViewerServer(opts: ServerOpts) {
     if (parts[0] !== "w" || !parts[1]) return send(res, 404, "not found");
     const wsid = parts[1];
     if (wsid === SHARES_WSID || wsid === TEMPLATES_WSID) return send(res, 404, "not found"); // reserved store wsids, never servable
+    // Trailing slash matters: index.html's relative assets (viewer.js/style.css) must resolve under
+    // /w/<wsid>/ — without it the browser fetches /w/viewer.js, which the SPA fallback answers with
+    // HTML, so the module load fails and the page is blank. Redirect the bare form so a hand-typed/
+    // clicked link without the slash still works (mirrors the /s/<token> redirect above). The URL
+    // fragment (#scope) is preserved by the browser across a fragment-less redirect.
+    if (parts.length === 2 && !url.pathname.endsWith("/")) {
+      res.writeHead(302, { location: `/w/${wsid}/${url.search}` });
+      res.end();
+      return;
+    }
     const action = parts[2] ?? "";
 
     // The built-in demo workspace is READ-ONLY and has no agent: every mutating endpoint is a POST
diff --git a/packages/viewer/test/server-static.test.ts b/packages/viewer/test/server-static.test.ts
index cd5e08a..ffe1db9 100644
--- a/packages/viewer/test/server-static.test.ts
+++ b/packages/viewer/test/server-static.test.ts
@@ -69,6 +69,23 @@ describe("static serving", () => {
     expect(await r.text()).toContain("VIEWER_INDEX");
   });
 
+  // A workspace URL without the trailing slash must redirect to the slashed form. Otherwise the
+  // browser resolves index.html's relative <script src="viewer.js"> against /w/ — fetching
+  // /w/viewer.js, which the SPA fallback answers with HTML, so the module load fails and the page
+  // is blank. (The /s/<token> share path already does this; /w/<wsid> must match.)
+  it("redirects /w/<wsid> (no trailing slash) to /w/<wsid>/", async () => {
+    const r = await fetch(`${base}/w/ws1`, { redirect: "manual" });
+    expect(r.status).toBe(302);
+    expect(r.headers.get("location")).toBe("/w/ws1/");
+  });
+
+  it("does not redirect the slashed workspace root or asset paths", async () => {
+    const root = await fetch(`${base}/w/ws1/`, { redirect: "manual" });
+    expect(root.status).toBe(200);
+    const asset = await fetch(`${base}/w/ws1/viewer-ABC123.js`, { redirect: "manual" });
+    expect(asset.status).toBe(200);
+  });
+
   it("does not serve files outside publicDir via traversal", async () => {
     const r = await fetch(`${base}/w/ws1/..%2f..%2fpackage.json`);
     expect(await r.text()).not.toContain("termchart-viewer");