Container Packaging Task 4 Report

Status

Implemented and verified runtime-configured frontend packaging.

Added the browser runtime contract window.__THOTHII_CONFIG__.backendBaseUrl.
Loaded /config.js before the Vite module entrypoint.
Made runtime configuration take precedence while preserving VITE_BACKEND_URL and the existing http://localhost:8787 client default for development and tests.
Added a multi-stage frontend image that builds with Node and serves static assets as unprivileged UID/GID 101:101 with nginx on port 8080.
Added startup-time BACKEND_BASE_URL substitution (default /api).
Added /api/ reverse proxying to core:8787, SPA fallback, no-cache runtime config, and SSE-safe proxy settings (proxy_buffering off, proxy_cache off, one-hour read timeout).

RED: npx vitest run src/api/runtime-config.test.ts failed because ./runtime-config did not exist.
GREEN: targeted runtime config suite passed (3 tests after preserving the legacy client default).

cd frontend && npx vitest run --reporter=dot && npx tsc -b && npm run build — exit 0 (40 test files, 185 tests; TypeScript and Vite production build passed).
docker build -f docker/frontend.Dockerfile -t thothii-frontend:test . — success.
Image metadata reports USER 101:101.
Two-container isolated-network smoke:
- /config.js returned window.__THOTHII_CONFIG__ = { backendBaseUrl: "/api" };
- /api/health proxied to the core image and returned {"status":"ok"}.
- an unknown nested route returned the SPA index.html.
- active nginx config contained proxy_buffering off, proxy_cache off, and proxy_read_timeout 1h.
- /config.js returned Cache-Control: no-store.
sh -n docker/frontend-entrypoint.sh and git diff --check — exit 0.

.dockerignore excludes .env* (except examples), credentials/key formats, dependency trees, build outputs, backend data, and deployment data.
The runtime web root contained no .env*, .pem, .key, .p12, or .pfx files.
Image history contained build/package instructions only; no secret build arguments or credential values were introduced by this task.

nginx resolves the core hostname at startup, matching the planned Compose service name; standalone runs therefore need a reachable network alias named core.
Existing frontend test warnings (React refs/act, MSW unmatched incidental requests, Vite chunk-size warnings) remain; they did not fail the requested gates and are unrelated to this task.
.superpowers/sdd/progress.md was already modified by the orchestrator and was intentionally excluded from this task's commit.

Follow-up commit work addressed both review findings:

Runtime configuration is now produced with jq -cn --arg, so BACKEND_BASE_URL is encoded by a real JSON serializer rather than interpolated into JavaScript by sed.
The image includes frontend-config-smoke, which strips only the fixed assignment wrapper, parses the remaining JSON with jq, requires exactly the backendBaseUrl key, and compares the decoded value to the environment input.
The hostile smoke passed with quotes, backslashes, a literal newline, ampersand, pipe, and "; globalThis.PWNED=true; // in the value. A breakout would leave non-JSON trailing input and fail parsing.
Added joinBackendPath, shared by API fetch and EventSource creation. It removes duplicate boundary slashes for relative and absolute bases while keeping empty and / bases rooted.

Follow-up verification:

RED: six join cases failed with joinBackendPath is not a function before implementation.
Targeted: runtime config, API client, and EventSource suites — 14 tests passed.
Full frontend gate — exit 0 (40 test files, 191 tests, TypeScript, Vite build).
Rebuilt thothii-frontend:test successfully.
Hostile config image smoke — frontend runtime config smoke: ok.
Rebuilt two-container smoke — default /api config, proxied /api/health, SPA fallback, and SSE-safe nginx directives all passed.