fix(docker): harden frontend runtime config

frontend/src/api/client.ts

@@ -1,4 +1,4 @@
-import { backendBaseUrl as BASE } from "./runtime-config";
+import { backendBaseUrl as BASE, joinBackendPath } from "./runtime-config";
 
 export async function apiFetch<T>(path: string, init?: RequestInit): Promise<T> {
   // Only declare a JSON content-type when we actually send a body. Body-less
@@ -10,7 +10,7 @@ export async function apiFetch<T>(path: string, init?: RequestInit): Promise<T>
   if (init?.body != null && !("content-type" in headers) && !("Content-Type" in headers)) {
     headers["content-type"] = "application/json";
   }
-  const res = await fetch(`${BASE}${path}`, { ...init, headers });
+  const res = await fetch(joinBackendPath(BASE, path), { ...init, headers });
   if (!res.ok) throw new Error(`${res.status} ${await res.text().catch(() => "")}`);
   return res.status === 204 ? (undefined as T) : ((await res.json()) as T);
 }

frontend/src/api/runtime-config.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { backendBaseUrl, resolveBackendUrl } from "./runtime-config";
+import { backendBaseUrl, joinBackendPath, resolveBackendUrl } from "./runtime-config";
 
 describe("resolveBackendUrl", () => {
   it("uses the runtime-injected backend URL", () => {
@@ -15,3 +15,16 @@ describe("resolveBackendUrl", () => {
     expect(backendBaseUrl).toBe(import.meta.env.VITE_BACKEND_URL ?? "http://localhost:8787");
   });
 });
+
+describe("joinBackendPath", () => {
+  it.each([
+    ["", "/sessions/s1", "/sessions/s1"],
+    ["/", "/sessions/s1", "/sessions/s1"],
+    ["/api", "/sessions/s1", "/api/sessions/s1"],
+    ["/api/", "/sessions/s1", "/api/sessions/s1"],
+    ["https://example.test/api", "/sessions/s1", "https://example.test/api/sessions/s1"],
+    ["https://example.test/api/", "sessions/s1", "https://example.test/api/sessions/s1"],
+  ])("joins base %j and path %j", (base, path, expected) => {
+    expect(joinBackendPath(base, path)).toBe(expected);
+  });
+});

frontend/src/api/runtime-config.ts

@@ -12,6 +12,12 @@ export function resolveBackendUrl(config: RuntimeConfig | undefined): string {
   return config?.backendBaseUrl ?? import.meta.env.VITE_BACKEND_URL ?? "";
 }
 
+export function joinBackendPath(base: string, path: string): string {
+  const normalizedBase = base === "/" ? "" : base.replace(/\/+$/, "");
+  const normalizedPath = path.replace(/^\/+/, "");
+  return `${normalizedBase}/${normalizedPath}`;
+}
+
 export const backendBaseUrl =
   resolveBackendUrl(typeof window === "undefined" ? undefined : window.__THOTHII_CONFIG__) ||
   "http://localhost:8787";

frontend/src/stream/useSessionStream.test.tsx

@@ -13,7 +13,7 @@ beforeEach(() => {
 test("opens an EventSource and feeds NAMED events to the store", () => {
   renderHook(() => useSessionStream("s1"));
   const es = FakeEventSource.instances[0];
-  expect(es.url).toContain("/sessions/s1/events");
+  expect(es.url).toBe("http://localhost:8787/sessions/s1/events");
   // Backend sends `event: ui_request` (named) — drive the addEventListener path
   // that production relies on, not the unnamed onmessage fallback.
   act(() =>

frontend/src/stream/useSessionStream.ts

@@ -1,5 +1,6 @@
 import { useEffect, useState } from "react";
 import { BASE } from "../api/client";
+import { joinBackendPath } from "../api/runtime-config";
 import { useSessionStore } from "../store/sessionStore";
 import type { StreamEvent } from "../api/types";
 
@@ -10,7 +11,7 @@ export function useSessionStream(sessionId: string | null) {
   useEffect(() => {
     if (!sessionId) return;
 
-    const es = new EventSource(`${BASE}/sessions/${sessionId}/events`);
+    const es = new EventSource(joinBackendPath(BASE, `/sessions/${sessionId}/events`));
     es.onopen = () => setConnected(true);
     es.onerror = () => setConnected(false);