fix(env): drop the getBaseUrl browser-origin fallback

[waleedlatif1]

Summary

• The window.location.origin fallback in getBaseUrl() was added in fix(env): restore beforeInteractive on the hosted public env script #6214 as a safety net while the real cause — the hosted env script losing its beforeInteractive strategy — was fixed in the same PR. With injection ordering restored, window.__ENV is populated before hydration, so the fallback is unreachable in any correctly configured deployment.
• Guessing the origin was also unsafe in the one case it could still fire. An opaque origin — a sandboxed iframe, and /chat/* is deliberately embeddable (no X-Frame-Options) — serializes to the string 'null', which is truthy. getBaseUrl() would have returned 'null' and every call site would have silently built null/api/.... A throw surfaces the misconfiguration instead of encoding it into request URLs.
• Restores the unconditional throw, mirrors it in the shared testing mock, and flips the two fallback tests to assert the throw (whitespace-only coverage kept).

Server-side behavior is unchanged. There was never a window to fall back to, so the server always threw. Callers that already guard getBaseUrl() — getBaseDomain(), and validateCallbackUrl() via #6217 — keep their existing fail-closed paths untouched.

Type of Change

• Bug fix

Testing

Full apps/sim suite: 18195 passed. The single failure is executor/handlers/pi/cloud-review-tools.test.ts, which shells out to rg via a python subprocess — ripgrep is a shell function rather than a binary on my machine, so it is an environment artifact unrelated to these files.

packages/testing suite passes (39). tsc clean, bun run lint:check clean. Also ran the structural gates: check:boundaries, check:client-boundary, check:realtime-prune, check:tool-registry-boundary, check:react-query, check:utils, check:api-validation — all pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 3, 2026 7:39pm

[cursor]

PR Summary

Medium Risk
Misconfigured or late env injection can now throw during client render where the fallback previously returned a URL; behavior is intentional but may surface config issues more aggressively in embed/sandbox edge cases.

Overview
getBaseUrl() no longer falls back to window.location.origin when NEXT_PUBLIC_APP_URL is missing or whitespace-only. It always throws with the existing misconfiguration message instead of guessing from the page origin.

That removes a path where opaque origins (e.g. sandboxed embeds on /chat/*) could yield the string 'null' and silently build null/api/... URLs. Server-side behavior was already throw-only; getInternalApiBaseUrl() and other callers that depend on getBaseUrl() now fail loudly in the browser too when env injection is wrong.

Tests assert throws for missing env in jsdom, and packages/testing urls.mock mirrors the same logic.

^{Reviewed by Cursor Bugbot for commit ba89105. Configure here.}

[greptile-apps]

Greptile Summary

Restores fail-fast URL configuration behavior by removing the browser-origin fallback from getBaseUrl().

• Throws when NEXT_PUBLIC_APP_URL is missing or blank instead of deriving a potentially invalid browser origin.
• Updates URL utility tests to assert the restored behavior.
• Keeps the shared testing mock aligned with production behavior.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The root layout injects public environment values before browser hydration, server behavior remains fail-fast, and the shared testing environment supplies a valid default application URL.

Important Files Changed

Filename	Overview
apps/sim/lib/core/utils/urls.ts	Removes the browser-origin fallback and consistently throws when the public application URL is not configured.
apps/sim/lib/core/utils/urls.test.ts	Updates missing and whitespace-only environment cases to verify fail-fast behavior.
packages/testing/src/mocks/urls.mock.ts	Aligns the shared mock with production while retaining browser-origin behavior for the other mock helpers that still require it.

_{Reviews (1): Last reviewed commit: "fix(env): drop the getBaseUrl browser-or..." | Re-trigger Greptile}

[waleedlatif1]

Folded into #6217 as 24f0940 — same review, one PR. The three commits are all follow-ups to the #6214 env-script race and touch the same URL-resolution surface, so splitting them just fragmented the review.