From b29fa240a615fc0edf6530045f85e10ad28145c5 Mon Sep 17 00:00:00 2001
From: Offending Commit <offendingcommit@gmail.com>
Date: Tue, 2 Jun 2026 11:53:42 -0500
Subject: [PATCH] refactor(web): drop same-origin sentinel from runtime config

---
 packages/web/src/lib/runtimeConfig.ts        | 19 ++++++-------------
 packages/web/src/test/runtime-config.test.ts | 18 +++++-------------
 2 files changed, 11 insertions(+), 26 deletions(-)

diff --git a/packages/web/src/lib/runtimeConfig.ts b/packages/web/src/lib/runtimeConfig.ts
index 235822b..c2990dd 100644
--- a/packages/web/src/lib/runtimeConfig.ts
+++ b/packages/web/src/lib/runtimeConfig.ts
@@ -1,24 +1,17 @@
 const GLOBAL_KEY = "__OPENCONCHO_DEFAULT_HONCHO_URL__";
-const SAME_ORIGIN = "same-origin";
 
 /**
  * Runtime-injected default Honcho base URL for container deployments.
  *
- * The Docker image writes `/config.js` from the `OPENCONCHO_DEFAULT_HONCHO_URL`
- * env at container start, so one prebuilt image can target any backend without
- * a rebuild (Vite envs are baked at build time and can't do this).
+ * The Docker image writes `/config.js` from `OPENCONCHO_DEFAULT_HONCHO_URL` at
+ * container start, so one prebuilt image can target any backend without a rebuild.
+ * The web build proxies this URL via the same-origin `/api` reverse proxy (no CORS).
  *
- * - `"same-origin"` → the page's own origin (pairs with the nginx `/v3` reverse
- *   proxy, so the browser makes same-origin requests and CORS never applies)
- * - an absolute URL → that URL
- * - empty / unset → `null` (no default; the user configures in Settings)
+ * - an absolute URL → that URL (seeds the first instance)
+ * - empty / unset → null (no default; the user configures in Settings)
  */
 export function runtimeDefaultBaseUrl(): string | null {
 	const raw = (globalThis as Record<string, unknown>)[GLOBAL_KEY];
 	if (typeof raw !== "string" || raw.trim() === "") return null;
-	const value = raw.trim();
-	if (value === SAME_ORIGIN) {
-		return typeof location !== "undefined" ? location.origin : null;
-	}
-	return value;
+	return raw.trim();
 }
diff --git a/packages/web/src/test/runtime-config.test.ts b/packages/web/src/test/runtime-config.test.ts
index a13e936..695ac8a 100644
--- a/packages/web/src/test/runtime-config.test.ts
+++ b/packages/web/src/test/runtime-config.test.ts
@@ -8,22 +8,14 @@ afterEach(() => {
 });
 
 describe("runtimeDefaultBaseUrl", () => {
-	it("returns null when the global is unset", () => {
-		expect(runtimeDefaultBaseUrl()).toBeNull();
-	});
-
-	it("returns null when the global is blank", () => {
-		(globalThis as Record<string, unknown>)[KEY] = "   ";
-		expect(runtimeDefaultBaseUrl()).toBeNull();
-	});
-
-	it("returns an absolute URL verbatim", () => {
+	it("returns an injected absolute URL verbatim", () => {
 		(globalThis as Record<string, unknown>)[KEY] = "https://honcho.example.net";
 		expect(runtimeDefaultBaseUrl()).toBe("https://honcho.example.net");
 	});
 
-	it("resolves 'same-origin' to the page origin", () => {
-		(globalThis as Record<string, unknown>)[KEY] = "same-origin";
-		expect(runtimeDefaultBaseUrl()).toBe(location.origin);
+	it("returns null when unset or empty", () => {
+		expect(runtimeDefaultBaseUrl()).toBeNull();
+		(globalThis as Record<string, unknown>)[KEY] = "   ";
+		expect(runtimeDefaultBaseUrl()).toBeNull();
 	});
 });