fix(public/index.html): wrap xfetch helper in <script> tags

630eea861cd2d47817e732f2eaad4aed2bb3cd63 · 2026-05-19 21:54:43 -0700 · Steve Abrams

xfetch was sitting OUTSIDE any <script> tag, wedged between the
react.production.min.js and react-dom.production.min.js script tags.
Browsers parsed it as text content → xfetch was undefined → every
api()/apiPost() call (lines 67-74, 88, 96, 105, 113) threw ReferenceError
on page load. George admin inbox UI was unusable in any browser.

Pure positional fix — wrapped the existing one-line function in
<script>...</script>. The inline basic-auth credential
("admin:DWSecure2024!") was already in this file at lines 60 + 66 before
this commit and is unchanged by it. Credential rotation across the fleet
is tracked separately (cred is also in dozens of sibling repos per MEMORY).

Surfaced by tick 169 session #102 Teal mechanical refactor pass; that
pass deferred the fix because the diff touches the cred line, but the
LIVE-BROKEN production UI takes precedence — fixing now, rotation later.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

M public/index.html

Diff

commit 630eea861cd2d47817e732f2eaad4aed2bb3cd63
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue May 19 21:54:43 2026 -0700

    fix(public/index.html): wrap xfetch helper in <script> tags
    
    xfetch was sitting OUTSIDE any <script> tag, wedged between the
    react.production.min.js and react-dom.production.min.js script tags.
    Browsers parsed it as text content → xfetch was undefined → every
    api()/apiPost() call (lines 67-74, 88, 96, 105, 113) threw ReferenceError
    on page load. George admin inbox UI was unusable in any browser.
    
    Pure positional fix — wrapped the existing one-line function in
    <script>...</script>. The inline basic-auth credential
    ("admin:DWSecure2024!") was already in this file at lines 60 + 66 before
    this commit and is unchanged by it. Credential rotation across the fleet
    is tracked separately (cred is also in dozens of sibling repos per MEMORY).
    
    Surfaced by tick 169 session #102 Teal mechanical refactor pass; that
    pass deferred the fix because the diff touches the cred line, but the
    LIVE-BROKEN production UI takes precedence — fixing now, rotation later.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 public/index.html | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/public/index.html b/public/index.html
index 81bbc28..7a8fc14 100644
--- a/public/index.html
+++ b/public/index.html
@@ -57,7 +57,9 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;backgrou
 <body>
 <div id="root"></div>
 <script src="https://unpkg.com/react@18/umd/react.production.min.js"></script>
+<script>
 function xfetch(url,opts){return new Promise(function(resolve,reject){var x=new XMLHttpRequest();x.open((opts&&opts.method)||"GET",url,true);x.setRequestHeader("Authorization","Basic "+btoa("admin:DWSecure2024!"));if(opts&&opts.body){x.setRequestHeader("Content-Type","application/json");}x.onload=function(){try{resolve({ok:x.status>=200&&x.status<300,status:x.status,json:function(){return Promise.resolve(JSON.parse(x.responseText))},text:function(){return Promise.resolve(x.responseText)}})}catch(e){reject(e)}};x.onerror=function(){reject(new Error("XHR failed"))};x.send(opts&&opts.body?JSON.stringify(opts.body):null)})};
+</script>
 <script src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script>
 <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script>
 <script type="text/babel">

← 941feb1 Snapshot-files cleanup: untrack server.js.bak-*, broaden .gi · back to George Gmail · george-gmail: recover prod hand-patches (basic-auth env migr ac33e88 →