Definitive fix: patch all 3 API URL sources for Docker same-origin serving

Dockerfile

@@ -11,38 +11,11 @@ COPY frontend/package.json ./frontend/
 
 RUN bun install --frozen-lockfile
 
-# Build static files (output lands in /app/frontend/dist)
+# Copy frontend source (already patched for Docker same-origin serving)
 COPY frontend/ ./frontend/
 
-# Write a patcher script that replaces the API URL placeholder with
-# window.location.origin in the compiled JS output. Using bun to run
-# the script ensures it works on Alpine (no sed/find compatibility issues).
-RUN cat > /tmp/patch_api.mjs << 'PATCHEOF'
-import { readdirSync, statSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-
-function walk(dir) {
-  for (const f of readdirSync(dir)) {
-    const p = join(dir, f);
-    if (statSync(p).isDirectory()) walk(p);
-    else if (f.endsWith(".js")) {
-      let c = readFileSync(p, "utf8");
-      if (c.includes("__OMNIVOICE_RUNTIME_ORIGIN__")) {
-        c = c.replaceAll('"__OMNIVOICE_RUNTIME_ORIGIN__"', "window.location.origin");
-        c = c.replaceAll("'__OMNIVOICE_RUNTIME_ORIGIN__'", "window.location.origin");
-        c = c.replaceAll("__OMNIVOICE_RUNTIME_ORIGIN__", "window.location.origin");
-        writeFileSync(p, c);
-        console.log("Patched:", p);
-      }
-    }
-  }
-}
-walk("/app/frontend/dist");
-PATCHEOF
-
-# Build with placeholder, then patch compiled JS to use window.location.origin
-RUN VITE_API_URL="__OMNIVOICE_RUNTIME_ORIGIN__" bun run --cwd frontend build && \
-    bun /tmp/patch_api.mjs
+# Build static files (output lands in /app/frontend/dist)
+RUN bun run --cwd frontend build
 
 # ==========================================
 # Runtime Stage: Python & PyTorch Backend

frontend/src/api/client.ts

@@ -1,8 +1,10 @@
-// Backend base URL. Configurable via VITE_API_URL or VITE_API_PORT env vars.
-// In production Tauri builds, the webview talks to the sidecar on localhost.
-const viteEnv = import.meta.env ?? {};
-const _port = viteEnv.VITE_API_PORT || '3900';
-export const API = viteEnv.VITE_API_URL || `http://127.0.0.1:${_port}`;
+// Docker/HF Spaces deployment: API client patched for same-origin serving.
+// Backend and frontend share the same origin, so we use window.location.origin.
+const _origin = typeof window !== 'undefined' && window.location
+  ? window.location.origin
+  : 'http://127.0.0.1:3900';
+
+export const API = _origin;
 
 export class ApiError extends Error {
   status?: number;

frontend/src/components/CaptureWidget.jsx

@@ -171,8 +171,7 @@ export default function CaptureWidget({ onDismiss }) {
       // Open WebSocket BEFORE starting recorder
       try {
         const wsProto = window.location.protocol === 'https:' ? 'wss' : 'ws';
-        const wsHost = API_BASE.replace(/^https?:\/\//, '').replace(/\/$/, '')
-          || `${window.location.hostname}:3900`;
+        const wsHost = window.location.host;
         const wsUrl = `${wsProto}://${wsHost}/ws/transcribe`;
         const ws = new WebSocket(wsUrl);
         ws.binaryType = 'arraybuffer';

frontend/src/utils/apiBase.ts

@@ -1,26 +1,8 @@
 /**
- * Centralised API base URL resolver.
+ * Centralised API base URL resolver — Docker/HF Spaces deployment.
  *
- * Single source of truth for "where is the OmniVoice backend reachable from
- * the currently-rendering frontend?". Three runtime contexts need different
- * answers:
- *
- *   1. Explicit override (Docker users / CI / power users):
- *        VITE_OMNIVOICE_API="http://10.0.0.5:3900"
- *      Always wins. Set in `.env.local` or the docker-compose env.
- *
- *   2. Tauri webview (the shipped desktop app):
- *      Backend always listens on 127.0.0.1:3900 on the same machine.
- *      Even when Tauri's webview origin is `tauri://localhost`, plain
- *      `http://localhost:3900` reaches the backend.
- *
- *   3. Plain browser (Docker LAN, port-forward, dev server on a NAS):
- *      The browser was served from some host — likely a LAN IP. We must
- *      target THAT host's :3900, not the browser machine's localhost.
- *      This closes issue #80 (Docker LAN frontend hits the wrong host).
- *
- * Plan: 01-03-PLAN.md (Phase 1 Wave 3)
- * Issue: #80
+ * In Docker, frontend and backend share the same origin (port 3900),
+ * so we simply use window.location.origin for everything.
  */
 
 declare global {
@@ -30,11 +12,8 @@ declare global {
   }
 }
 
-/** Backend port — kept here as a single constant so we never grep-replace
- *  hard-coded `3900` across the codebase again. */
 export const BACKEND_PORT = 3900;
 
-/** True when the current execution context is a Tauri webview. */
 export function isTauriContext(): boolean {
   return (
     typeof window !== "undefined" &&
@@ -42,47 +21,11 @@ export function isTauriContext(): boolean {
   );
 }
 
-/**
- * Resolve the backend API base URL for the current runtime context.
- *
- * Returns a URL with NO trailing slash so callers can safely concatenate
- * `/preview/upload` etc.
- */
-/** Test-only override for the env-resolved API base. vitest 4.x does not
- *  propagate `vi.stubEnv` to dynamically imported modules' `import.meta.env`,
- *  so we expose this small hook for tests. Production code never sets it. */
-let _testEnvOverride: string | undefined = undefined;
-export function _setEnvOverrideForTesting(value: string | undefined): void {
-  _testEnvOverride = value;
-}
-
-function _readEnvOverride(): string | undefined {
-  if (_testEnvOverride !== undefined) return _testEnvOverride;
-  const env = (import.meta as unknown as { env?: Record<string, string | undefined> }).env;
-  return env?.VITE_OMNIVOICE_API;
-}
-
 export function getApiBase(): string {
-  // 1. Explicit override always wins.
-  const override = _readEnvOverride();
-  if (override) {
-    return stripTrailingSlash(override);
-  }
-
-  // 2. Tauri webview → loopback.
-  if (isTauriContext()) {
-    return `http://localhost:${BACKEND_PORT}`;
-  }
-
-  // 3. Plain browser → follow the page's own origin/host.
+  // Docker/HF Spaces: same-origin serving
   if (typeof window !== "undefined" && window.location) {
-    const { protocol, hostname } = window.location;
-    if (hostname) {
-      return `${protocol}//${hostname}:${BACKEND_PORT}`;
-    }
+    return window.location.origin;
   }
-
-  // 4. SSR / vitest jsdom without window — safe fallback.
   return `http://localhost:${BACKEND_PORT}`;
 }
 
@@ -90,9 +33,6 @@ function stripTrailingSlash(url: string): string {
   return url.endsWith("/") ? url.slice(0, -1) : url;
 }
 
-/** Module-level cached base URL — resolved once at import time. Most callers
- *  want this; only call `getApiBase()` directly if you need to re-evaluate
- *  after env or window changes (rare, mostly tests). */
 export const API_BASE: string = getApiBase();
 
 export default API_BASE;