Summary

• Resolve frontend HTTP, WebSocket, fetch, download, and local-content URLs relative to the document base URL.
• Emit relative Vite and PWA asset paths so the application can run below an arbitrary reverse-proxy prefix.
• Keep authentication, local browser/editor navigation, error-page redirects, and the opt-in service worker within the application scope.
• Preserve the existing root-mounted behavior as a fallback when no browser document is available.

Motivation

The application currently assumes it is mounted at /. That breaks assets, API calls, WebSockets, local file navigation, and PWA resources when it is exposed through a path-based reverse proxy such as /proxy/5900/.

This change derives the public URL prefix from document.baseURI, so the server does not need provider-specific configuration or knowledge of the external proxy path.

Validation

• npm run test:unit — 16 files, 153 tests passed
• npm exec -- vue-tsc --noEmit
• npm exec -- vite build
• npm exec -- tsup
• JupyterHub + jupyter-server-proxy smoke test at /user/<name>/proxy/4200/
  • document and relative assets returned HTTP 200
  • API endpoint returned HTTP 200
  • WebSocket connection succeeded
  • browser recorded 35 requests with no same-origin request escaping the proxy prefix
• Opt-in service worker test through an HTTP subpath proxy
  • registration scope remained under /proxy-test/
  • shell cache codexweb-shell-v3 was created
  • no request escaped the proxy prefix

Notes

Service worker registration remains opt-in through VITE_ENABLE_SERVICE_WORKER=1. Root-mounted deployments continue to resolve to the same endpoints as before.