From ed07f2b94dbe8d28acfac90ee6cb5aaf59baaa09 Mon Sep 17 00:00:00 2001
From: David Crespo <david.crespo@oxidecomputer.com>
Date: Thu, 9 Apr 2026 00:34:24 -0500
Subject: [PATCH 1/2] move theme-init.js to assets/

---
 public/{ => assets}/theme-init.js |  0
 vite.config.ts                    | 16 ++++++++--------
 2 files changed, 8 insertions(+), 8 deletions(-)
 rename public/{ => assets}/theme-init.js (100%)

diff --git a/public/theme-init.js b/public/assets/theme-init.js
similarity index 100%
rename from public/theme-init.js
rename to public/assets/theme-init.js
diff --git a/vite.config.ts b/vite.config.ts
index 396c72f8b4..5d7923d290 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -133,21 +133,21 @@ export default defineConfig(({ mode }) => ({
     },
     {
       // Inject theme-init.js as a classic (non-module) render-blocking script
-      // so it sets data-theme before first paint. It lives in public/ so it
-      // passes CSP default-src 'self'. We inject it here rather than putting
-      // it in index.html because Vite tries to bundle any <script src> it finds
-      // there. Content hash query param handles cache-busting since public/
-      // files aren't fingerprinted by Vite. We cache static assets for a year,
-      // so we need the hash.
+      // so it sets data-theme before first paint. It lives in public/assets/
+      // so it passes CSP default-src 'self' and is served by the /assets/*
+      // route in Nexus. We inject it here rather than putting it in index.html
+      // because Vite tries to bundle any <script src> it finds there. Content
+      // hash query param handles cache-busting since public/ files aren't
+      // fingerprinted by Vite.
       name: 'theme-init',
       transformIndexHtml() {
-        const content = readFileSync(resolve(__dirname, 'public/theme-init.js'))
+        const content = readFileSync(resolve(__dirname, 'public/assets/theme-init.js'))
         const hash = createHash('sha256').update(content).digest('hex').slice(0, 8)
         return [
           {
             injectTo: 'head-prepend',
             tag: 'script',
-            attrs: { src: `/theme-init.js?v=${hash}` },
+            attrs: { src: `/assets/theme-init.js?v=${hash}` },
           },
         ]
       },

From adda9e7bbe6dbc8f0d92e9df31bd56e85756ee37 Mon Sep 17 00:00:00 2001
From: David Crespo <david.crespo@oxidecomputer.com>
Date: Thu, 9 Apr 2026 09:50:20 -0500
Subject: [PATCH 2/2] safety test that would have prevented this tragedy

---
 app/api/__tests__/safety.spec.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/app/api/__tests__/safety.spec.ts b/app/api/__tests__/safety.spec.ts
index c31f4621a2..2af4a0cff1 100644
--- a/app/api/__tests__/safety.spec.ts
+++ b/app/api/__tests__/safety.spec.ts
@@ -83,6 +83,18 @@ it('e2e tests are only in test/e2e or test/visual', () => {
   }
 })
 
+// In production, Nexus only serves /assets/* and /index.html — files at other
+// paths under public/ would work in Vite dev but 404 in production.
+// https://github.com/oxidecomputer/omicron/blob/b2b1e39/nexus/src/external_api/console_api.rs#L409-L439
+it('public/ only contains assets/', () => {
+  const entries = fs.readdirSync(path.resolve(__dirname, '../../../public'))
+  expect(entries).toMatchInlineSnapshot(`
+    [
+      "assets",
+    ]
+  `)
+})
+
 // 8-4-4-4-12 hex digits
 const UUID_RE = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'