# Container Packaging Task 4 Report

## Status

Implemented and verified runtime-configured frontend packaging.

## Changes

- Added the browser runtime contract `window.__THOTHII_CONFIG__.backendBaseUrl`.
- Loaded `/config.js` before the Vite module entrypoint.
- Made runtime configuration take precedence while preserving `VITE_BACKEND_URL` and the
  existing `http://localhost:8787` client default for development and tests.
- Added a multi-stage frontend image that builds with Node and serves static assets as
  unprivileged UID/GID `101:101` with nginx on port 8080.
- Added startup-time `BACKEND_BASE_URL` substitution (default `/api`).
- Added `/api/` reverse proxying to `core:8787`, SPA fallback, no-cache runtime config,
  and SSE-safe proxy settings (`proxy_buffering off`, `proxy_cache off`, one-hour read timeout).

## TDD evidence

- RED: `npx vitest run src/api/runtime-config.test.ts` failed because
  `./runtime-config` did not exist.
- GREEN: targeted runtime config suite passed (3 tests after preserving the legacy client
  default).

## Verification

- `cd frontend && npx vitest run --reporter=dot && npx tsc -b && npm run build` — exit 0
  (40 test files, 185 tests; TypeScript and Vite production build passed).
- `docker build -f docker/frontend.Dockerfile -t thothii-frontend:test .` — success.
- Image metadata reports `USER 101:101`.
- Two-container isolated-network smoke:
  - `/config.js` returned `window.__THOTHII_CONFIG__ = { backendBaseUrl: "/api" };`
  - `/api/health` proxied to the core image and returned `{"status":"ok"}`.
  - an unknown nested route returned the SPA `index.html`.
  - active nginx config contained `proxy_buffering off`, `proxy_cache off`, and
    `proxy_read_timeout 1h`.
  - `/config.js` returned `Cache-Control: no-store`.
- `sh -n docker/frontend-entrypoint.sh` and `git diff --check` — exit 0.

## Secret-leakage inspection

- `.dockerignore` excludes `.env*` (except examples), credentials/key formats, dependency
  trees, build outputs, backend data, and deployment data.
- The runtime web root contained no `.env*`, `.pem`, `.key`, `.p12`, or `.pfx` files.
- Image history contained build/package instructions only; no secret build arguments or
  credential values were introduced by this task.

## Self-review / concerns

- nginx resolves the `core` hostname at startup, matching the planned Compose service name;
  standalone runs therefore need a reachable network alias named `core`.
- Existing frontend test warnings (React refs/act, MSW unmatched incidental requests, Vite
  chunk-size warnings) remain; they did not fail the requested gates and are unrelated to
  this task.
- `.superpowers/sdd/progress.md` was already modified by the orchestrator and was intentionally
  excluded from this task's commit.