Normalize E2E base-path handling and harden static file serving in run_e2e.mjs

[Copilot]

This PR addresses review-thread feedback on web/e2e/run_e2e.mjs: E2E_BASE_PATH handling was brittle for slash variants, and request-path handling could throw on missing URLs and allow traversal outside dist/. It updates path normalization and request resolution so subpath E2E runs are robust and constrained to the build output root.

• Base-path normalization

  • Added normalization for E2E_BASE_PATH so inputs like /coBroc, coBroc/, and /coBroc/ resolve consistently to /coBroc.
  • Ensures prefix stripping logic behaves consistently for subpath simulation.

• Request URL safety

  • Guarded against undefined/empty req.url with a stable default ('/').
  • Normalized incoming path shape before further processing.

• Traversal protection for static serving

  • Switched to resolved absolute paths from a fixed DIST_ROOT.
  • Added boundary check to reject requests that resolve outside dist/ with 403.

const BASE_PATH = normalizeBasePath(process.env.E2E_BASE_PATH || '');
let urlPath = (req.url ?? '/').split('?')[0] || '/';

const p = resolve(DIST_ROOT, `.${urlPath === '/' ? '/index.html' : urlPath}`);
if (p !== DIST_ROOT && !p.startsWith(`${DIST_ROOT}${sep}`)) {
  res.writeHead(403);
  res.end();
  return;
}

[Copilot]

Pull request overview

This PR updates the web/e2e/run_e2e.mjs E2E runner’s static server to behave consistently when simulating GitHub Pages-style subpaths and to constrain static file resolution to the dist/ output directory.

Changes:

• Normalizes E2E_BASE_PATH to a consistent '' or '/name' form (no trailing slash).
• Hardens request URL handling by defaulting missing req.url to '/' and normalizing to a leading /.
• Switches static serving to resolve() + DIST_ROOT boundary checks to prevent path traversal outside dist/.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.