From 7a119364833e1f50ae65e95ea6dc07860bb31453 Mon Sep 17 00:00:00 2001
From: Jeff Emmett <jeffemmett@gmail.com>
Date: Wed, 4 Mar 2026 10:03:38 -0800
Subject: [PATCH] fix: resolve mixed-content error in thread builder API calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bare-domain rewrite (rspace.online/rsocials/thread → /demo/rsocials/thread)
injected /demo/ into __BASE_PATH__, causing fetches to /demo/rsocials/api/threads
which triggered a 301 redirect to http://demo.rspace.online (mixed content blocked).
Now derives the base path from the actual browser URL. Also fixed layout so compose
input is on the left and thread preview is on the right.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 modules/rsocials/mod.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/rsocials/mod.ts b/modules/rsocials/mod.ts
index 4b66f63..f046d39 100644
--- a/modules/rsocials/mod.ts
+++ b/modules/rsocials/mod.ts
@@ -702,6 +702,7 @@ const THREAD_CSS = `
 .thread-image-preview { border-radius: 8px; overflow: hidden; border: 1px solid #334155; }
 .thread-image-preview[hidden] { display: none; }
 .thread-image-preview img { display: block; max-width: 200px; height: auto; }
+#share-link-area { grid-column: 1 / -1; }
 .thread-share-link {
 	display: flex; align-items: center; gap: 0.5rem; padding: 0.4rem 0.75rem;
 	background: rgba(99,102,241,0.1); border: 1px solid #6366f1; border-radius: 8px;
@@ -818,7 +819,9 @@ function renderThreadBuilderPage(space: string, threadData?: ThreadData | null):
 		</div>
 	</div>
 	<script type="module">
-		const base = window.__BASE_PATH__ || './';
+		// Derive base from actual URL — bare-domain rewrites inject /demo/ which isn't in the browser path
+		const declared = window.__BASE_PATH__ || './';
+		const base = window.location.pathname.startsWith(declared) ? declared : declared.replace(/^\\/[^\\/]+/, '');
 		let currentThreadId = null;
 		let autoSaveTimer = null;