Files
Jordan Ritter 09b9f8910b chore(showcase): pre-push cleanup -- comment rot, log levels, env coalesce, test hardening
Non-functional cleanup pass on the showcase deploy-pipeline integration
branch. All changes are scoped to comment rot, log severity for already-
demoted runtime-config fields, length-aware env-name coalescing (a
deliberately-empty primary no longer masks a populated alternate), and
test-quality tightening. No production behavior change beyond the
specific items below.

Changes by area:

- shell/shell-dashboard/shell-docs runtime-config.ts: factor the
  `process.env[primary] ?? process.env[alt]` chain into a shared
  length-aware `readEnvPair` helper. The prior `??` form treated
  `PRIMARY=""` as set, masking a populated alternate; the helper now
  treats empty-string as unset and falls through to the alternate.
- shell-docs runtime-config.ts: demote the two recoverable URL fields
  (`intelligenceSignupUrl`, `posthogHost`) from console.info to
  console.warn. The `FATAL-CONFIG:` Sentry-alert prefix is preserved
  only on the true sentinels; the demoted fields now clear prod log-
  aggregation thresholds without raising ops alerts.
- All three shells' runtime-config.ts: prefix log lines with the shell
  name (e.g. `[shell-docs runtime-config]`) so the shared log stream
  identifies which shell emitted the line.
- shell-docs runtime-config-serialize.ts: rewrite the U+2028 / U+2029
  RegExp arguments using six-character ASCII backslash-u escape
  sequences (was: literal codepoints in the string arg). The literal
  codepoints are line terminators that a formatter or editor could
  silently strip, breaking the security-critical XSS escape. The
  ASCII form is robust to any such pass.
- shell-docs use-google-analytics.test.ts: de-tautologize the hook-
  order test. It now asserts `usePathname(` and `useEffect(` both
  exist in the source, so deleting all hooks would fail the test
  rather than trivially satisfying the early-return path.
- shell-dashboard baseline-types.test.ts: update the partner-count
  expectation from 25 to 26 -- the 26th entry (Cloudflare) is a
  legitimate integration that landed independently; the test was
  stale and had nothing to do with this branch.
- scripts/resolve-verify-matrix.ts: drop the `FIX 7 --` plan-
  internal prefix from a comment; keep the explanation.
- shell-docs/.env.example: correct the `NEXT_PUBLIC_SHELL_URL`
  fallback claim (sentinel, not canonical prod host) and document
  the remaining 7 consumed env vars with their FATAL/warn/silent
  semantics so the example matches runtime-config.ts.

Skipped:
- C-SENTINEL-DEDUP (`http://ops.invalid` shared constant across
  shell-dashboard's next.config.ts and runtime-config.ts): both
  files are at different module levels (root vs src/lib) and the
  string appears once in each; extracting to a shared module would
  widen the diff into a refactor for marginal benefit. Skipped per
  the spec's "if it widens diff awkwardly, skip" guidance.
- C-SSRTEST: already exhaustively covered. Each of the three shells
  has an SSR placeholder test that exercises every URL field via
  `new URL()` parseability and (for shell-docs) the analytics-key
  empty-string semantics. Treated as a no-op.

Validation: shell + shell-dashboard + shell-docs runtime-config /
serialize / GA tests green; bin/showcase Ruby suite green (87 runs);
showcase/scripts resolve-verify-matrix + aggregate-build-results +
lint-rule-no-public-env green (79 runs).
2026-05-29 11:45:15 -07:00

57 lines
2.7 KiB
Bash

# shell-docs environment variables.
#
# All values below are read at REQUEST time (not at build time) — a
# single built artifact can serve staging and prod by pointing them at
# different hosts. See src/lib/runtime-config.ts for the authoritative
# resolution rules; the summary below is a quick reference.
#
# URL-FATAL semantics: missing in production logs a `FATAL-CONFIG:`
# error (Sentry-alerted) and falls back to a sentinel URL (visible
# breakage) or — for fields with a working prod default — a non-fatal
# warn and the default. Analytics-KEY semantics: missing is the empty
# string with NO log (consumers no-op on empty).
#
# Severity by field:
# FATAL-CONFIG on miss: NEXT_PUBLIC_BASE_URL, NEXT_PUBLIC_SHELL_URL
# Non-fatal warn on miss (working prod default):
# NEXT_PUBLIC_INTELLIGENCE_SIGNUP_URL,
# NEXT_PUBLIC_POSTHOG_HOST
# Silent ("" empty default, no log):
# NEXT_PUBLIC_POSTHOG_KEY,
# NEXT_PUBLIC_SCARF_PIXEL_ID,
# NEXT_PUBLIC_GOOGLE_ANALYTICS_TRACKING_ID,
# NEXT_PUBLIC_REB2B_KEY,
# NEXT_PUBLIC_REO_KEY
# Canonical base URL used by sitemap.ts, robots.ts, and the per-page
# canonical metadata. In production this points at the docs host so
# crawlers index every framework variant at its self-canonical URL.
# FATAL on miss in prod, falls back to the canonical prod host
# (https://docs.copilotkit.ai).
NEXT_PUBLIC_BASE_URL=https://docs.copilotkit.ai
# URL of the showcase shell host, which owns /integrations and /matrix.
# Used by the top-nav cross-host links and InlineDemo. Replace with your
# deployment's shell host. FATAL on miss in prod, falls back to the
# sentinel `about:blank#shell-url-missing` (visible breakage).
NEXT_PUBLIC_SHELL_URL=https://www.copilotkit.ai
# Intelligence platform signup URL — drives the signup-link CTA and the
# ops-platform-cta. Non-fatal warn on miss in prod; falls back to
# https://dashboard.operations.copilotkit.ai/ which is a real working
# host, so absence is recoverable.
# NEXT_PUBLIC_INTELLIGENCE_SIGNUP_URL=https://dashboard.operations.copilotkit.ai/
# PostHog host — analytics destination for `posthog-js`. Non-fatal warn
# on miss in prod; falls back to https://eu.i.posthog.com (the EU cloud
# default that matches prior middleware behavior).
# NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
# Analytics keys — empty string disables that analytics channel.
# Legitimately absent in non-production envs; NO log on miss.
# NEXT_PUBLIC_POSTHOG_KEY=
# NEXT_PUBLIC_SCARF_PIXEL_ID=
# NEXT_PUBLIC_GOOGLE_ANALYTICS_TRACKING_ID=
# NEXT_PUBLIC_REB2B_KEY=
# NEXT_PUBLIC_REO_KEY=