From 45aad35efabec9b416280f3f5454210e211535c8 Mon Sep 17 00:00:00 2001
From: Void <void@minds.void.gamecult.org>
Date: Sun, 8 Nov 2026 02:12:11 +0000
Subject: [PATCH] preview-demo: drop the submit-event shim; manifest link
 relative

The host's CSP map grants allow-forms to /void/rat-* (live nginx, minds.gamecult.org), so native form submission fires its submit event and deliverSubmitEvents has nothing left to do. The manifest link was host-root (/manifest.json, a 404 under /void/rat-*); ./manifest.json resolves under the build's base.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 index.html                  |  2 +-
 src/preview-demo/install.ts | 32 --------------------------------
 2 files changed, 1 insertion(+), 33 deletions(-)

diff --git a/index.html b/index.html
index c9042aff..2585704c 100644
--- a/index.html
+++ b/index.html
@@ -23,7 +23,7 @@
 
     <link id="favicon" rel="shortcut icon" href="./public/favicon.ico" />
 
-    <link rel="manifest" href="/manifest.json" />
+    <link rel="manifest" href="./manifest.json" />
     <meta name="mobile-web-app-capable" content="yes" />
     <meta name="application-name" content="Ratatoskr" />
     <meta name="apple-mobile-web-app-title" content="Ratatoskr" />
diff --git a/src/preview-demo/install.ts b/src/preview-demo/install.ts
index 36990a57..b182a935 100644
--- a/src/preview-demo/install.ts
+++ b/src/preview-demo/install.ts
@@ -41,37 +41,6 @@ const showBanner = (text: string) => {
   document.body.appendChild(el);
 };
 
-// The preview host's CSP sandbox has no allow-forms, so the browser cancels a native form
-// submission before its submit event fires and no login button works. Deliver the event ourselves;
-// nothing is submitted natively. Remove this when the host grants allow-forms to /void/rat-*.
-const deliverSubmitEvents = (doc: Document) => {
-  const submit = (form: HTMLFormElement) =>
-    form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
-  doc.addEventListener(
-    'click',
-    (e) => {
-      const button = (e.target as Element | null)?.closest?.(
-        'button[type="submit"], input[type="submit"]'
-      );
-      const form = (button as HTMLButtonElement | null)?.form;
-      if (!form || (button as HTMLButtonElement).disabled) return;
-      e.preventDefault();
-      submit(form);
-    },
-    true
-  );
-  doc.addEventListener(
-    'keydown',
-    (e) => {
-      const target = e.target as HTMLInputElement | null;
-      if (e.key !== 'Enter' || e.isComposing || target?.tagName !== 'INPUT' || !target.form) return;
-      e.preventDefault();
-      submit(target.form);
-    },
-    true
-  );
-};
-
 const parseBody = (body: unknown): unknown => {
   if (typeof body !== 'string') return undefined;
   try {
@@ -139,7 +108,6 @@ export const installDemo = (win: Window & typeof globalThis = window) => {
       routeOf(String(url), origin) === 'own' ? realBeacon(url, data) : false;
   }
 
-  deliverSubmitEvents(document);
   const stored = win.localStorage.getItem('cinny_hs_base_url');
   showBanner(stored !== null && stored !== DEMO_ORIGIN ? FOREIGN_SESSION_TEXT : BANNER_TEXT);
   return server;