Container Packaging Task 4 Report

Status

Implemented and verified runtime-configured frontend packaging.

Added the browser runtime contract window.__THOTHII_CONFIG__.backendBaseUrl.
Loaded /config.js before the Vite module entrypoint.
Made runtime configuration take precedence while preserving VITE_BACKEND_URL and the existing http://localhost:8787 client default for development and tests.
Added a multi-stage frontend image that builds with Node and serves static assets as unprivileged UID/GID 101:101 with nginx on port 8080.
Added startup-time BACKEND_BASE_URL substitution (default /api).
Added /api/ reverse proxying to core:8787, SPA fallback, no-cache runtime config, and SSE-safe proxy settings (proxy_buffering off, proxy_cache off, one-hour read timeout).

RED: npx vitest run src/api/runtime-config.test.ts failed because ./runtime-config did not exist.
GREEN: targeted runtime config suite passed (3 tests after preserving the legacy client default).

cd frontend && npx vitest run --reporter=dot && npx tsc -b && npm run build — exit 0 (40 test files, 185 tests; TypeScript and Vite production build passed).
docker build -f docker/frontend.Dockerfile -t thothii-frontend:test . — success.
Image metadata reports USER 101:101.
Two-container isolated-network smoke:
- /config.js returned window.__THOTHII_CONFIG__ = { backendBaseUrl: "/api" };
- /api/health proxied to the core image and returned {"status":"ok"}.
- an unknown nested route returned the SPA index.html.
- active nginx config contained proxy_buffering off, proxy_cache off, and proxy_read_timeout 1h.
- /config.js returned Cache-Control: no-store.
sh -n docker/frontend-entrypoint.sh and git diff --check — exit 0.

.dockerignore excludes .env* (except examples), credentials/key formats, dependency trees, build outputs, backend data, and deployment data.
The runtime web root contained no .env*, .pem, .key, .p12, or .pfx files.
Image history contained build/package instructions only; no secret build arguments or credential values were introduced by this task.

nginx resolves the core hostname at startup, matching the planned Compose service name; standalone runs therefore need a reachable network alias named core.
Existing frontend test warnings (React refs/act, MSW unmatched incidental requests, Vite chunk-size warnings) remain; they did not fail the requested gates and are unrelated to this task.
.superpowers/sdd/progress.md was already modified by the orchestrator and was intentionally excluded from this task's commit.