server: serve static files from memory (macOS sendfile fix)

[ZukwiZ]

Summary

http.ServeFile uses the sendfile(2) fast path on darwin which truncates responses to the first TCP segment (~512 bytes) on some local setups, so the browser receives a corrupt index.html. Read the file into memory and write it with w.Write so the response is portable across platforms.

Tiny in scope:

• one new helper (serveStaticFile) for the index route
• one new handler (staticDirHandler) for the /static/* wildcard, with .. path-traversal rejection
• Content-Type derived from extension via mime.TypeByExtension, falling back to http.DetectContentType

The static payload is HTML + a handful of icons, so the read-on-every-request cost is negligible. No behavior change for clients.

Test plan

• `go test ./...` passes
• `curl -I http://localhost:80/\` returns a `Content-Length` matching the size of `static/index.html`
• `curl -I http://localhost:80/static/` returns a correct `Content-Length` for a static asset
• `curl http://localhost:80/static/../config.json\` returns 404 (traversal rejected)

Made with Cursor

---

Note

Low Risk
Small static-only HTTP surface with basic path traversal rejection; no auth, API, or data-layer changes.

Overview
Replaces http.ServeFile for the root route with an in-memory handler that reads static/index.html on each request and writes the full body with explicit Content-Type and Content-Length, avoiding Darwin sendfile truncation that could corrupt HTML in local dev.

Adds a /static/* route backed by staticDirHandler, which serves assets from the static directory the same way (read + w.Write), sets MIME type from the file extension (with http.DetectContentType fallback), and returns 404 for empty paths or .. traversal attempts.

^{Reviewed by Cursor Bugbot for commit a701758. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a701758. Configure here.}

[cursor]

Hardcoded URL prefix instead of chi wildcard param

Low Severity

staticDirHandler extracts the relative path via strings.TrimPrefix(r.URL.Path, "/static/"), hardcoding the /static/ URL prefix rather than using chi.URLParam(r, "*"). The rest of the codebase consistently uses chi.URLParam for route parameter extraction. This couples the handler's internals to the route registration string and will silently break if the route is ever moved to a sub-router (where chi rewrites r.URL.Path).

 

^{Reviewed by Cursor Bugbot for commit a701758. Configure here.}