[object Object]

← back to Cronjobs Viewer

5x contrarian gate: remove duplicate weaker window.fetch guard (keep canonical head guard); verify creds-in-URL + grid-populated (280 cards)

e60d08e1b39d0a7300853c98954b7c97aa2f74d2 · 2026-08-25 11:37:03 -0700 · steve

Files touched

Diff

commit e60d08e1b39d0a7300853c98954b7c97aa2f74d2
Author: steve <steve@designerwallcoverings.com>
Date:   Tue Aug 25 11:37:03 2026 -0700

    5x contrarian gate: remove duplicate weaker window.fetch guard (keep canonical head guard); verify creds-in-URL + grid-populated (280 cards)
---
 5x/creds-url-test.js | 13 +++++++++++++
 5x/grid-populated.js | 14 ++++++++++++++
 public/index.html    | 20 ++++----------------
 3 files changed, 31 insertions(+), 16 deletions(-)

diff --git a/5x/creds-url-test.js b/5x/creds-url-test.js
new file mode 100644
index 0000000..f43859f
--- /dev/null
+++ b/5x/creds-url-test.js
@@ -0,0 +1,13 @@
+const pw = require('/Users/macstudio3/.npm-global/lib/node_modules/playwright');
+const CHROME='/Applications/Google Chrome.app/Contents/MacOS/Google Chrome';
+(async()=>{
+  const b=await pw.chromium.launch({executablePath:CHROME});
+  const ctx=await b.newContext(); const p=await ctx.newPage();
+  const errs=[]; p.on('console',m=>{if(m.type()==='error')errs.push(m.text())}); p.on('pageerror',e=>errs.push('PAGEERR '+e.message));
+  // open WITH creds embedded in the URL — the exact bug the guard prevents
+  await p.goto('http://admin:DW2024!@127.0.0.1:9772/',{waitUntil:'networkidle',timeout:20000}).catch(e=>errs.push('GOTO '+e.message));
+  await p.waitForTimeout(1500);
+  const cards=await p.$$eval('.host',els=>els.length).catch(()=>0);
+  console.log('cards rendered:',cards,'| console errors:',errs.length?errs.join(' || '):'none');
+  await b.close();
+})();
diff --git a/5x/grid-populated.js b/5x/grid-populated.js
new file mode 100644
index 0000000..bfede35
--- /dev/null
+++ b/5x/grid-populated.js
@@ -0,0 +1,14 @@
+const pw = require('/Users/macstudio3/.npm-global/lib/node_modules/playwright');
+const CHROME='/Applications/Google Chrome.app/Contents/MacOS/Google Chrome';
+(async()=>{
+  const b=await pw.chromium.launch({executablePath:CHROME});
+  const ctx=await b.newContext({httpCredentials:{username:'admin',password:'DW2024!'}});
+  const p=await ctx.newPage();
+  await p.goto('http://127.0.0.1:9772/',{waitUntil:'networkidle',timeout:20000});
+  await p.waitForSelector('#grid .card',{timeout:8000}).catch(()=>{});
+  const cards=await p.$$eval('#grid .card',e=>e.length).catch(()=>0);
+  const errCards=await p.$$eval('#grid .card.error',e=>e.length).catch(()=>0);
+  const stats=await p.$eval('#stats',e=>e.textContent.replace(/\s+/g,' ').trim()).catch(()=>'(none)');
+  console.log('grid .card count:',cards,'| error cards:',errCards,'| stats bar:',stats);
+  await b.close();
+})();
diff --git a/public/index.html b/public/index.html
index 933e35a..61ed577 100644
--- a/public/index.html
+++ b/public/index.html
@@ -143,22 +143,10 @@
 <div class="foot" id="foot"></div>
 
 <script>
-// Guard against the creds-in-URL fetch bug: when the page is opened as
-// http://admin:PASS@host/ (Basic-auth in the URL), those creds persist in
-// document.baseURI, and a relative fetch() throws "Request cannot be
-// constructed from a URL that includes credentials". Resolve every relative
-// URL against location.origin (which has NO creds) before fetching.
-(function(){
-  const _f = window.fetch.bind(window);
-  window.fetch = function(input, init){
-    try{
-      if(typeof input === 'string' && !/^https?:\/\//i.test(input)){
-        input = new URL(input, location.origin).href;
-      }
-    }catch(e){}
-    return _f(input, init);
-  };
-})();
+// creds-in-URL fetch guard already installed in the <head> (canonical fleet
+// drop-in — handles string + Request, preserves pathname). A second, weaker
+// copy here used to double-wrap window.fetch; removed 2026-08-25 (/5x contrarian
+// gate). Do NOT re-add — the head guard is the single source of truth.
 const $ = (s)=>document.querySelector(s);
 let DATA = {jobs:[]};

← 62c68e7 5x: REPORT + capture harness (2 clean sweeps, favicon 404 fi  ·  back to Cronjobs Viewer  ·  feat: wire liveness pill → /api/liveness/:label on-demand re 93fa8a7 →