Filed by the PM on behalf of the #5544 dev agent, whose search-before-file step was blocked by a GitHub API rate limit. Found during PR #5658.
The pre-boot branding script inlined at apps/console/index.html:49 reads window.__CONSOLE_SERVER_URL — which is set nowhere in this repository — while every module-side consumer reads import.meta.env.VITE_SERVER_URL (apps/console/src/main.tsx:65).
Consequence: a dev setup that points the console at a separate server via VITE_SERVER_URL has the two code paths targeting different origins — the inline script fetches /api/v1/runtime/config against the Vite dev origin, 404s, and early branding silently never applies. Pre-existing, dev-only: both resolve to '' in production builds (same-origin), which is why PR #5658's dedup works there.
Not graded — severity is a triage call. The narrow fix is to inject the same value the modules read (or drop the inline fetch now that PR #5658 shares the in-flight promise between the two callers, which may make the inline script's fetch redundant entirely — worth checking before patching the variable).
Filed by the PM on behalf of the #5544 dev agent, whose search-before-file step was blocked by a GitHub API rate limit. Found during PR #5658.
The pre-boot branding script inlined at
apps/console/index.html:49readswindow.__CONSOLE_SERVER_URL— which is set nowhere in this repository — while every module-side consumer readsimport.meta.env.VITE_SERVER_URL(apps/console/src/main.tsx:65).Consequence: a dev setup that points the console at a separate server via
VITE_SERVER_URLhas the two code paths targeting different origins — the inline script fetches/api/v1/runtime/configagainst the Vite dev origin, 404s, and early branding silently never applies. Pre-existing, dev-only: both resolve to''in production builds (same-origin), which is why PR #5658's dedup works there.Not graded — severity is a triage call. The narrow fix is to inject the same value the modules read (or drop the inline fetch now that PR #5658 shares the in-flight promise between the two callers, which may make the inline script's fetch redundant entirely — worth checking before patching the variable).