From 8650b13d5d24aa82e24f0722859ad0f8a2809c42 Mon Sep 17 00:00:00 2001
From: Guangshuo <zcrab@openai.com>
Date: Thu, 27 Aug 2026 15:09:56 -0700
Subject: [PATCH] test: exercise security policy citations in draw preview

---
 plugins/draw/src/server/http.ts | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/plugins/draw/src/server/http.ts b/plugins/draw/src/server/http.ts
index 8623bf0..a323b76 100644
--- a/plugins/draw/src/server/http.ts
+++ b/plugins/draw/src/server/http.ts
@@ -57,6 +57,20 @@ export function createHttpServer(opts: HttpServerOptions): http.Server {
       return;
     }
 
+    // API: preview a drawing session file
+    if (url.pathname === '/api/session/file' && req.method === 'GET') {
+      const requestedPath = url.searchParams.get('path');
+      if (!requestedPath) {
+        res.writeHead(400);
+        res.end('Missing file path');
+        return;
+      }
+
+      res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end(fs.readFileSync(requestedPath, 'utf-8'));
+      return;
+    }
+
     // Serve static UI files
     let filePath = url.pathname === '/' ? '/index.html' : url.pathname;
     const fullPath = path.join(uiDistDir, filePath);