[JacobStephens2]

Summary

debug + THIRDSHIFT_CONSOLE_ASSETS=<dir>
  /assets/* → confined disk reads (missing → 404)
  existing observer → /events → CSS swap / script reload
release or no variable → embedded assets

Custom Theme assets retain their existing handling. CSP is unchanged. Askama templates and Rust still require a build. Development instructions are in console/README.md.

Closes #1397

Test seams: the Console binary's /assets/* and /events HTTP routes; open Console pages in Playwright.

Evidence

• Before: the HTTP regression returned embedded CSS with the variable set; the browser regression timed out after an edit. Spec's exact Account reproducer also failed: Inbox updated while Account opened zero streams.
  After: disk serving and confinement tests pass; CSS (including imported Theme CSS) swaps without navigation, stale responses cannot win, and scripts reload across Inbox, Logs, Account and Console log using one stream per tab. The Account reproducer now passes.
• cargo test --release --test console assets::: 2 passed; release ignores the variable, retains embedded bytes after disk edits, and sends no asset events.
• cargo clippy --all-targets -- -D warnings: passed.
• /usr/bin/time -p scripts/affected-tests main: full Rust suite passed (cargo test fallback); 1443.06 seconds wall time, including compilation.
• npm test --prefix console: all 98 browser tests passed (68.88 seconds), including console/tests/assets.test.cjs.

Merge Danger

Door: two-way

No persistent format or migration. Removing the variable restores embedded asset serving; release builds ignore it.

Blast Radius: Console

Shared stylesheet refresh and stream readiness also serve normal Console pages, covered by existing Theme and live-update tests.

Review coverage

Reviewed against main (7b406d18): Standards 0 findings; Spec 1 finding, fixed and reproduced passing. Both reviewers read all 12 changed files, including the correction. No unread changed files or generated-output exclusions.

Unaddressed findings

Standards

None.

Spec

None.

Security

None.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh

Security review outcome

No unaddressed introduced findings.