[zwanski-start]

Problem

On some Windows machines the registry maps .js to text/plain. Python's mimetypes module reads the registry, so Starlette's StaticFiles/FileResponse serve the Vite bundle as text/plain and the browser refuses to run the module script, which leaves a blank page.

Fix

server/main.py now calls mimetypes.add_type at import time for .js/.mjs (text/javascript), .css, .svg, .json and .wasm. add_type initializes the mimetypes DB first (registry included) and then overrides it, so these mappings always win.

Verification

• New test_mime_types.py fakes a bad registry mapping (.js → text/plain), reloads server.main, and asserts the correct types are restored. It passes.
• Ran uvicorn locally and requested a built asset: the response had content-type: text/javascript; charset=utf-8.
• ruff check passes. mypy reports no errors in the changed files; the existing errors in other files are untouched.

Assumptions

• I couldn't test on Windows. The registry behavior is the documented root cause (see the CPython/Starlette reports), and the override is platform-independent.

Closes #49

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Guido (cubefarm agent, in a fresh session) · Round: 1 · Author: Dennis

The PR overrides MIME types for .js/.mjs/.css/.svg/.json/.wasm in server/main.py at import time, so a bad Windows registry mapping can no longer make the server send UI assets as text/plain. With a bad mapping simulated (.js and .css set to text/plain before import), master still served CSS as text/plain and the UI rendered unstyled, while the PR served correct types and the UI rendered fully with no console errors. Note: master already had a .js-only workaround in server/routers/settings.py:18 (now redundant), so the PR's real gain is the CSS/SVG/etc. coverage in one place. Lint, the new regression test, the security tests and the UI build pass; the 21 pytest failures and 25 mypy errors are the same on master.

	Check	Details
✅	Issue repro: assets served with wrong MIME type under a bad registry mapping	Started the server through a wrapper that calls mimetypes.init() and then maps .js/.css to text/plain before importing server.main, to imitate a bad Windows registry. Master: .js was text/javascript (thanks to the existing settings.py workaround) but .css was text/plain. PR: .js text/javascript, .css text/css, .svg image/svg+xml.
✅	Browser render under the bad mapping (PR vs master)	Chromium via Playwright. PR: React root mounted, the CSS loaded (322 rules), the project-selection screen rendered fully styled, 0 console errors or warnings. Master under the same mapping: the stylesheet was rejected and the page rendered unstyled (huge logo, browser-default buttons).
✅	Regression test actually catches the bug	test_mime_types.py fails against master's server/main.py and passes on the PR branch.
✅	Code review	Six mimetypes.add_type calls placed before StaticFiles and FileResponse are used. add_type loads the system database (registry included) first, then overrides it. No debug code, no security impact, cross-platform. Minor, not blocking: the .js line in server/routers/settings.py:18 is now redundant.
✅	Backend boot, REST routes and WebSocket	Plain uvicorn server.main:app on 127.0.0.1:5820: /api/health 200, unknown project 404, path traversal 404, unknown paths fall back to text/html. ws://.../ws/projects/nonexistent connects and returns a 'Project not found in registry' error message.
✅	Full pytest suite	145 passed, 21 failed. The 21 failures (test_devserver_security.py) are the same on master (diffed the failure lists); the only difference is the one new passing test.
✅	Security tests	test_security.py and test_security_integration.py both pass; security.py and the localhost-only middleware are unchanged.
✅	Frontend build and lint	tsc -b plus vite build succeeds; ESLint 0 errors, 6 warnings. The PR doesn't touch the UI, so test:e2e was not run.
✅	Phone-width layout	Resized to 390x844; the app still renders. The squeezed sidebar layout is the same on master and not caused by this PR.
⏭️	Real Windows registry test	No Windows machine available; the bad mapping was simulated through Python's mimetypes, which is where the registry value ends up.

🧪 Commands run

Command	Result
ruff check .	All checks passed
mypy .	25 errors in 10 files, the same count as master; the changed files add none
python -m pytest -q	145 passed, 21 failed (the same 21 fail on master: test_devserver_security.py)
python -m pytest -q test_mime_types.py	1 passed on the PR; 1 failed against master's server/main.py
python test_security.py	ALL TESTS PASSED
python test_security_integration.py	ALL INTEGRATION TESTS PASSED
npm --prefix ui ci && npm --prefix ui run build	build succeeded
npm --prefix ui run lint	0 errors, 6 warnings
python badreg_run.py 5820 (wrapper simulating .js/.css -> text/plain), then curl assets, PR vs master	master: css text/plain; PR: js text/javascript, css text/css, svg image/svg+xml
uvicorn server.main:app --host 127.0.0.1 --port 5820, then curl and websockets probes	health 200, missing project 404, traversal 404, SPA fallback text/html, WS connects and returns an error message

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}