chat: guard registry+chat fetch against creds-in-URL (resolve vs location.origin) — fixes empty pickers on user:pass@host bookmarks (TK-11084)

cf095c7baa3f6cb592a447a263cdd8936510026f · 2026-09-01 18:00:40 -0700 · Steve

Files touched

M public/js/chat.js

Diff

commit cf095c7baa3f6cb592a447a263cdd8936510026f
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Sep 1 18:00:40 2026 -0700

    chat: guard registry+chat fetch against creds-in-URL (resolve vs location.origin) — fixes empty pickers on user:pass@host bookmarks (TK-11084)
---
 public/js/chat.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/public/js/chat.js b/public/js/chat.js
index 1ee22cf..c4a68d7 100644
--- a/public/js/chat.js
+++ b/public/js/chat.js
@@ -158,7 +158,7 @@
     const thinking = bubble('assistant', '…thinking');
     sendBtn.disabled = true;
     try {
-      const res = await fetch('/api/chat', {
+      const res = await fetch(location.origin + '/api/chat', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ message, modelId: model.id, agentId: agent.id, history: history.slice(-10) }),
@@ -182,7 +182,10 @@
 
   async function boot() {
     try {
-      const res = await fetch('/api/chat/registry');
+      // Resolve against location.origin (never carries credentials) so a
+      // user:pass@host bookmark can't poison document.baseURI and throw
+      // "Request cannot be constructed from a URL that includes credentials".
+      const res = await fetch(location.origin + '/api/chat/registry');
       registry = await res.json();
     } catch (_) {
       return;

← ee61b91 chat: move Model/Agent pickers to a centered top-middle nav · back to AbramsOS · chore: lint, refactor, v0.6.0 (session close) — nav-bar chat 144d126 →