From f3c6ecdd4b61b0c4be36d65b9636b86b0036777a Mon Sep 17 00:00:00 2001 From: brookr <11095+brookr@users.noreply.github.com> Date: Tue, 7 Jul 2026 01:36:39 -0700 Subject: [PATCH 1/2] Document WS_ENDPOINT in .env.sample for local development Without WS_ENDPOINT set, the realtime websocket URL is derived from API_ENDPOINT via a replace that only rewrites the production 'https://api...' host. A localhost API then yields an insecure 'ws://localhost' URL that the CSP connect-src (wss: only) blocks, so live wave updates silently fail in local dev. Documenting the var spares developers that confusion. Co-Authored-By: Claude Fable 5 Signed-off-by: brookr <11095+brookr@users.noreply.github.com> --- .env.sample | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.env.sample b/.env.sample index 9c939258cc..61dce8da49 100644 --- a/.env.sample +++ b/.env.sample @@ -1,6 +1,14 @@ # SEIZE API ENDPOINT - for production, use 'https://api.6529.io' API_ENDPOINT= +# REALTIME WEBSOCKET ENDPOINT - for production, use 'wss://ws.6529.io'. +# Set this in local development to your backend's ws port (e.g. +# 'ws://localhost:3000'). When unset, the app derives the URL from +# API_ENDPOINT, but that only rewrites the production 'https://api...' host; +# a localhost API therefore yields an insecure 'ws://localhost' URL that the +# Content-Security-Policy blocks, so live wave updates fail locally. +WS_ENDPOINT= + # ALLOWLIST API ENDPOINT - for production, use 'https://allowlist-api.6529.io' ALLOWLIST_API_ENDPOINT= From e3d3f9bdd1b2b37d6638c3dc5bbb6c5b82902581 Mon Sep 17 00:00:00 2001 From: brookr <11095+brookr@users.noreply.github.com> Date: Tue, 14 Jul 2026 02:25:00 -0700 Subject: [PATCH 2/2] Fix WS_ENDPOINT sample: comment out the line, correct fallback note CodeRabbit caught two problems: an uncommented empty WS_ENDPOINT= fails env validation when the sample is copied verbatim (the schema rejects empty strings and next.config fail-fasts), and the note claimed a CSP block when a localhost API_ENDPOINT actually reaches the WebSocket constructor unchanged and fails there. Signed-off-by: brookr <11095+brookr@users.noreply.github.com> --- .env.sample | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/.env.sample b/.env.sample index cb4c85636e..b83bedaf0e 100644 --- a/.env.sample +++ b/.env.sample @@ -1,13 +1,15 @@ # SEIZE API ENDPOINT - for production, use 'https://api.6529.io' API_ENDPOINT= -# REALTIME WEBSOCKET ENDPOINT - for production, use 'wss://ws.6529.io'. -# Set this in local development to your backend's ws port (e.g. -# 'ws://localhost:3000'). When unset, the app derives the URL from -# API_ENDPOINT, but that only rewrites the production 'https://api...' host; -# a localhost API therefore yields an insecure 'ws://localhost' URL that the -# Content-Security-Policy blocks, so live wave updates fail locally. -WS_ENDPOINT= +# REALTIME WEBSOCKET ENDPOINT (optional) - for production, use +# 'wss://ws.6529.io'. Set this in local development to your backend's ws port +# (e.g. 'ws://localhost:3000'). When unset, the app derives the URL from +# API_ENDPOINT, but that only rewrites the production 'https://api...' host to +# 'wss://ws...'; any other API_ENDPOINT (such as a localhost URL) is passed to +# the WebSocket constructor unchanged and fails, so live wave updates don't +# work locally without setting this. Keep the line commented out when unused: +# an empty value fails env validation ('WS_ENDPOINT must be a valid URL'). +# WS_ENDPOINT= # ALLOWLIST API ENDPOINT - for production, use 'https://allowlist-api.6529.io' ALLOWLIST_API_ENDPOINT=