fix(frontend): update env vars for dev

[NathanFlurry]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
rivet-inspector	Error			Dec 1, 2025 6:01am

3 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
rivet-cloud	Ignored			Dec 1, 2025 6:01am
rivet-site	Ignored	Preview		Dec 1, 2025 6:01am
rivetkit-serverless	Skipped			Dec 1, 2025 6:01am

[NathanFlurry]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(examples): add user-generated-actors example #3560
• feat(frontend): create api key #3556
• fix(frontend): do not show tokens button if not on namespace page #3558
• fix(frontend): update env vars for dev #3557 👈 (View in Graphite)
• docs: clean up last few missing pieces of content #3538
• main

---

How to use the Graphite Merge Queue

Add the label merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: fix(frontend): update env vars for dev

Summary

This PR simplifies the frontend environment configuration by removing the __AUTO__ API endpoint detection logic and cleaning up redundant environment variable transformations. The changes streamline local development setup.

Code Quality ✅

Positive aspects:

• Simplified logic: Removed complex auto-detection logic (__AUTO__) that had hardcoded references to old domains (hub., api.staging2.gameinc.io)
• Clear comments: Added helpful inline comments explaining the purpose of configuration options
• Consistency: Applied changes uniformly across both config files (frontend/packages/components/src/lib/config.ts and frontend/src/components/lib/config.ts)
• Better dev experience: .env now explicitly sets both VITE_APP_API_URL and VITE_APP_CLOUD_API_URL to localhost, making local development more straightforward

Observations:

• Removed VITE_APP_CLOUD_ENGINE_URL from schema (line 27 in env.ts) - ensure this variable is not used elsewhere in the codebase
• The duplicate VITE_APP_API_URL transform in cloudEnvSchema was correctly removed

Potential Issues ⚠️

1. Code duplication: There are two nearly identical config.ts files:

   • frontend/packages/components/src/lib/config.ts
   • frontend/src/components/lib/config.ts

   The only difference is the SSR-safe typeof window !== "undefined" check in the second file. Consider consolidating these or documenting why both exist.

2. Missing validation: The getApiEndpoint() function in frontend/packages/components/src/lib/config.ts:30 uses location.origin without checking if window/location is defined. This could cause issues in SSR contexts. The other file correctly guards this with typeof window !== "undefined".

   Recommendation: Add the same guard:

   const getApiEndpoint = (apiEndpoint: string) => {
   	// __SAME__ is used in Docker builds to serve API from the same origin as the frontend
   	if (typeof window !== "undefined" && apiEndpoint === "__SAME__") {
   		return window.location.origin;
   	}
   	return apiEndpoint;
   };

3. Clerk key in .env: The .env file now includes VITE_APP_CLERK_PUBLISHABLE_KEY=pk_test_.... While this is a test key and likely safe, verify this is intentional for local development (appears to be based on the comment pattern for PostHog).

Performance Considerations ✅

No performance concerns. The changes actually improve performance by removing unnecessary hostname checks and string replacements.

Security Concerns ✅

• The removal of dynamic endpoint detection reduces the attack surface
• Environment variables are properly validated through Zod schemas
• Clerk test key appears to be a public test key (safe to commit)

Test Coverage ❓

Recommendation: Consider adding tests for:

• getApiEndpoint() function with both __SAME__ and regular URL inputs
• Environment variable schema validation, especially the new VITE_APP_CLOUD_API_URL requirement

Dependencies 📦

• Updated @rivet-gg/cloud package reference from bf2ebb2 to 1fcfb72 - ensure this version is compatible and tested

Action Items

Required:

• Fix SSR safety issue in frontend/packages/components/src/lib/config.ts:30 by adding typeof window !== "undefined" check

Recommended:

• Verify VITE_APP_CLOUD_ENGINE_URL removal does not break any cloud-specific functionality
• Consider consolidating the two config.ts files to reduce duplication
• Add unit tests for getApiEndpoint() function

Nice to have:

• Document in comments why __SAME__ vs direct URLs are used in different contexts

Overall Assessment

This is a good cleanup PR that simplifies the development setup. The main concern is the SSR safety issue in one of the config files. Once that is addressed, this should be good to merge.

Verdict: ✅ Approve with minor fix required