Dev productivity improvements

[vklimontovich]

Summary

• Portless dev hosts. pnpm console:dev / pnpm ee-api:dev now serve at https://console.jitsu.localhost / https://ee.jitsu.localhost via portless. New pnpm ui:dev runs both in parallel through turbo.
• Auto-detected branch suffix. When the current git branch is not the repo's default branch (resolved via git rev-parse origin/HEAD), the host becomes https://console-<branch>.jitsu.localhost / https://ee-<branch>.jitsu.localhost. Branch is sanitized for DNS (lowercased, [^a-z0-9-] → -, capped at 30 chars). Pass --no-branch to opt out.
• dev-scripts workspace package with a pnpm dev <subcommand> dispatcher. Bare pnpm dev runs turbo run dev as before.
• pnpm dev copy-db --src URL --dst URL — full-database clone via pg_dump | psql. $ENV_VAR placeholders in URLs are resolved against process.env (populated by the layered .env.local loading — see below). Drops and recreates the dst database (prompts first; pass --clean-dst to skip the prompt). Skips all CREATE EXTENSION statements so dst doesn't need plv8/vector/etc. installed. Strips top-level SET statements from the dump so newer pg_dump versions can feed older dst servers. By default a few large log/audit tables (betteruptime.events, newjitsu.StatusChange, newjitsu.AuditLog, newjitsu.source_task) are structure-only — pass --all-tables to include their rows.
• Layered .env.local loading, no wrapper. Single mechanism replaces five scattered loaders (dotenv-cli, tsx --env-file-if-exists, process.loadEnvFile, hand-rolled parser, plus duplicates). node --inspect and your debugger attach to the script's own process — no dotenv-cli parent in the tree. See "Env resolution" below.
• AUTH_COOKIE_DOMAIN env var for NextAuth. Set to .jitsu.localhost in dev to share the session across console.jitsu.localhost / ee.jitsu.localhost and any branch hosts. Unset in production — when unset, behavior is unchanged (cookie stays host-only, no Domain attribute).
• Next.js 16.2.3 → 16.2.6 (console + ee-api + bundle-analyzer + eslint-config-next). Patch bump.
• allowedDevOrigins: ["*.jitsu.localhost"] in both Next configs so next dev doesn't block cross-origin _next/* requests from the portless hosts.
• turbopack.root pinned to the repo root in both Next configs. Without it, Next walks up looking for a lockfile and on a worktree picks up the main checkout's pnpm-workspace.yaml, which makes Turbopack's module graph panic.
• Drop unused root scripts — release / release:canary / release:build-scripts (the cli/build-scripts package they referenced doesn't exist) and the monorel + semantic-release* devDeps that backed them. Also drops the obsolete sync-bulker.sh.

Why dash style for branch subdomains

*.jitsu.localhost (single-level wildcard) covers every host in dash style, so a single Firebase Authorized-Domains entry is all that's ever needed. Dot style (console.<branch>.jitsu.localhost) would require either per-branch console clicks or a multi-level wildcard.

Implementation note: dev-scripts/src/bin/run-app.ts runs portless from a non-git scratch dir to sidestep portless's hardcoded dot-style worktree prefix, and wraps the actual command as bash -c "cd <ws> && <cmd>" so it executes at the workspace cwd.

Env resolution

Two .env.local layers, auto-loaded for every node process spawned by a pnpm script (later wins; existing process.env always wins; missing files skipped silently):

1. ~/.jitsu/.env.local — shared across all worktrees of all branches (Firebase, Stripe, OIDC, GitHub OAuth — anything that doesn't change per branch).
2. <repo>/.env.local — per-worktree (DATABASE_URL, NEXTAUTH_URL, AUTH_COOKIE_DOMAIN, anything branch-specific).

How: root .npmrc sets node-options=--require=env-preload. pnpm exports that as NODE_OPTIONS for every script-spawned node process. The preload (env-preload/preload-env.cjs, ~50 LOC of plain CommonJS) loads the shared file, then walks up from process.cwd() to find pnpm-workspace.yaml and load the repo .env.local. (Why a preload, not --env-file-if-exists: Node disallows --env-file* in NODE_OPTIONS for security; --require is allowed.)

What this drops: dotenv-cli from root + console + rotor; dotenv direct dep from ee-api + dev-scripts; the loadRepoEnv block in run-app.ts; the hand-rolled parser in dev-scripts/src/utils/env.ts; the dotenv-cli spawn in dev-scripts/src/index.ts; --env-file-if-exists flags in rotor + console scripts.

See CONTRIBUTING.md → Environment variables for the full story.

Setup

pnpm install   # portless is a workspace devDep; first run prompts once for sudo to bind 443 + trust the local CA

pnpm console:dev                      # → https://console.jitsu.localhost (on default branch)
pnpm console:dev --no-branch          # → https://console.jitsu.localhost (force, on any branch)
pnpm ee-api:dev                       # → https://ee.jitsu.localhost
pnpm ui:dev                           # both, in parallel

On a feature branch, the suffix is auto-applied: e.g. on dev-productivity-improvements you get https://console-dev-productivity-improv.jitsu.localhost.

In Firebase Console → Authentication → Settings → Authorized domains, add *.jitsu.localhost once.

For shared secrets across worktrees:

mkdir -p ~/.jitsu && chmod 700 ~/.jitsu
touch ~/.jitsu/.env.local && chmod 600 ~/.jitsu/.env.local
# put Firebase / Stripe / OIDC / GitHub OAuth keys here

In <repo>/.env.local for shared session across console/ee/branch hosts:

AUTH_COOKIE_DOMAIN=.jitsu.localhost

Test plan

• pnpm install clean
• pnpm dev help shows subcommands
• On default branch, pnpm console:dev opens at https://console.jitsu.localhost
• On a feature branch, pnpm console:dev opens at https://console-<branch>.jitsu.localhost
• pnpm console:dev --no-branch opens at https://console.jitsu.localhost regardless of branch
• Firebase login works on both with *.jitsu.localhost authorized
• With AUTH_COOKIE_DOMAIN=.jitsu.localhost: log in once on console, ee-api recognizes the session
• pnpm dev copy-db --src '$DATABASE_URL' --dst 'postgres://...local-dev' prompts to drop dst, then clones
• pnpm dev copy-db --src ... --dst ... --clean-dst skips the prompt
• pnpm dev copy-db --src ... --dst ... --all-tables includes data for the otherwise structure-only tables
• Env resolution: pnpm exec node -e 'console.log(process.env.DATABASE_URL ? "SET" : "UNSET")' prints SET if <repo>/.env.local defines it; same from inside any workspace dir
• Debugger sanity: pnpm console:dev boots; attach Node debugger; confirm no dotenv-cli parent in the process tree and process.env shows the layered values

[jitsu-code-review]

I found two correctness/safety issues in the new copy-db tool that should be fixed before merge.

[jitsu-code-review]

Found one correctness issue that can cause destructive data loss in copy-db when src/dst use different host aliases for the same DB endpoint.

[jitsu-code-review]

Found one correctness issue in the new env layering logic that can cause the wrong environment values to be used in dev.

[jitsu-code-review]

Found one correctness regression in the new env preload path.

• currently prevents repo-level from overriding because it checks the live while loading each layer. That reverses the intended precedence documented in the PR (shared first, then repo override).

Please adjust the loader so only pre-existing environment variables are protected, while later file layers can override earlier file layers.

[jitsu-code-review]

Found one correctness regression in the new env preload path.

• env-preload/preload-env.cjs currently prevents repo-level .env.local from overriding ~/.jitsu/.env.local because it checks the live process.env while loading each layer. That reverses the intended precedence documented in the PR (shared first, then repo override).

Please adjust the loader so only pre-existing environment variables are protected, while later file layers can override earlier file layers.

[jitsu-code-review]

Found one correctness/safety issue that can still cause destructive data loss in copy-db.

Dismissing stale bot review: duplicate of the previously-resolved host-aliasing concern (#discussion_r3209668650). Author chose to keep the simple host/port/database string compare for this dev-only tool — see thread reply.