fix(app): declare API_URL and APP_URL in the build task env

[R0drig0Diaz]

The bug

apps/app/turbo.json overrides the root build.env, and the override drops two names the root config declares:

// root turbo.json
"build": { "env": ["API_URL", "APP_URL", "NEXT_PUBLIC_API_URL"] }

// apps/app/turbo.json  (replaces it, does not merge)
"build": { "env": ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] }

Neither API_URL nor APP_URL appears in globalPassThroughEnv either, so for app#build both are invisible.

next.config.ts then does this:

const apiUrl = process.env.API_URL ?? process.env.NEXT_PUBLIC_API_URL ?? "http://localhost:3001";
env: { NEXT_PUBLIC_API_URL: apiUrl }

With API_URL hidden it resolves to the localhost fallback, and Next inlines that into the build. apps/app/lib/env.ts reads the inlined value, so apps/app/app/api/[...path]/route.ts proxies to http://localhost:3001 in production.

How it presents

The sign-in page renders normally and every call behind it fails:

API proxy: http://localhost:3001 is not reachable for POST /api/auth/sign-in/social
[cause]: Error: connect ECONNREFUSED 127.0.0.1:3001

The UI shows only "Could not reach the sign-in service." API_URL was set correctly on the deployment the entire time, which is what makes it hard to find: nothing in the platform, the build log, or the app reports a missing variable.

This is a documented failure class in this repo

docs/environment.md, under "A new variable has three homes, not two":

Turborepo hides an undeclared variable from every task it runs, so a deployment that sets the variable perfectly still hands the code undefined, and nothing anywhere says so. That is how MICROSOFT_CLIENT_ID shipped with the sign-in button quietly missing.

Same mechanism, one level down: the per-package task override rather than the global list.

Why env and not passThroughEnv

docs/environment.md says "passThroughEnv, never env" for secrets, because a secret in env becomes a cache key. These two are the opposite case. They are public URLs and they are build-time inputs: API_URL is inlined into the bundle via NEXT_PUBLIC_API_URL. If it were only in passThroughEnv, changing the API host would not invalidate the build cache and a restored cache would keep serving the previous host.

APP_URL is included for the same reason: next.config.ts reads it at build time for allowedDevOrigins.

Verification

Reproduced on a live Vercel deployment, and fixed there by setting NEXT_PUBLIC_API_URL directly, which works precisely because that name is declared. Before and after, same deployment:

Request	Before	After
GET /api/auth/ok via the app	502	200
GET /api/auth/get-session via the app	502	200
GET /api/trpc/sso.signInOptions via the app	fetch failed	{"google":true}
POST /api/auth/sign-in/social via the app	502	returns the Google authorize URL

This PR fixes the cause, so API_URL alone is sufficient as the docs and .env.example imply.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes the app build task so API_URL and APP_URL are no longer hidden from Turborepo, preventing the production API proxy from falling back to http://localhost:3001 and causing 502 errors on sign-in and API calls. The per-package build task in apps/app/turbo.json overrides the root env list and omitted these two names, so next.config.ts saw them as undefined and inlined the localhost fallback. Declaring them in env (not passThroughEnv) means build caches invalidate when these URLs change, which is required because they are inlined via NEXT_PUBLIC_API_URL.

^{Written for commit d1cc81f. Summary will update on new commits.}

[vercel]

@R0drig0Diaz is attempting to deploy a commit to the Comp AI - PoC Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/turbo.json">

<violation number="1" location="apps/app/turbo.json:10">
P2: This fix re-declares the root env values by hand instead of merging them, so it stays fragile. Per the Turborepo docs, a per-package `turbo.json` array field like `env` completely replaces the root value by default; the documented way to append to the inherited list is the `$TURBO_EXTENDS$` microsyntax as the first element. Because this change hardcodes API_URL/APP_URL/NEXT_PUBLIC_API_URL (already in the root `build.env`) plus NEXT_PUBLIC_AUTH_URL, the next variable added to the root `build.env` is silently dropped from the app build again — the exact failure class this PR claims to fix. Replace the hardcoded list with `$TURBO_EXTENDS$` so future root additions propagate automatically.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This fix re-declares the root env values by hand instead of merging them, so it stays fragile. Per the Turborepo docs, a per-package turbo.json array field like env completely replaces the root value by default; the documented way to append to the inherited list is the $TURBO_EXTENDS$ microsyntax as the first element. Because this change hardcodes API_URL/APP_URL/NEXT_PUBLIC_API_URL (already in the root build.env) plus NEXT_PUBLIC_AUTH_URL, the next variable added to the root build.env is silently dropped from the app build again — the exact failure class this PR claims to fix. Replace the hardcoded list with $TURBO_EXTENDS$ so future root additions propagate automatically.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/turbo.json, line 10:

<comment>This fix re-declares the root env values by hand instead of merging them, so it stays fragile. Per the Turborepo docs, a per-package `turbo.json` array field like `env` completely replaces the root value by default; the documented way to append to the inherited list is the `$TURBO_EXTENDS$` microsyntax as the first element. Because this change hardcodes API_URL/APP_URL/NEXT_PUBLIC_API_URL (already in the root `build.env`) plus NEXT_PUBLIC_AUTH_URL, the next variable added to the root `build.env` is silently dropped from the app build again — the exact failure class this PR claims to fix. Replace the hardcoded list with `$TURBO_EXTENDS$` so future root additions propagate automatically.</comment>

<file context>
@@ -6,7 +6,12 @@
 			"outputs": [".next/**", "!.next/cache/**", "!.next/dev/**"],
-			"env": ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"],
+			"env": [
+				"API_URL",
+				"APP_URL",
+				"NEXT_PUBLIC_API_URL",
</file context>