feat(dev): prompt for a base URL in setup-env, defaulting to unset

[IamCoder18]

Summary

pnpm dev:setup-env now prompts for a BASE_URL ("the URL you use to access the dev server") at the start, before the NEXTAUTH_URL prompt. When provided, it becomes the default for NEXTAUTH_URL (which the user can still override) and APP_URL_OVERRIDE is also written so auth and server-side redirects resolve at the same public origin — useful for LAN testing (http://192.168.1.82:3100) and dev URLs behind Cloudflare Access (https://clouddev.example.com). Pressing enter leaves both unset, so NEXTAUTH_URL falls back to the http://localhost:3000 example default. CI mode (--ci) skips the BASE_URL prompt and preserves the existing CI placeholders.

Both prompts share a URL validator with a non-fatal recovery menu (no fatal exit):

• Rejects whitespace/quotes/newlines/# (env-reserved), unparseable input, non-http/https protocol, missing hostname.
• Suggests a fix when the input is missing a protocol (e.g. 192.168.1.82:3100 → http://192.168.1.82:3100).
• On invalid input: prints the error, offers [r] Re-enter / [s] Use suggested (when available) / [d] Use default or clear. Enter defaults to d.

APP_URL_OVERRIDE is appended to .env.local since it isn't in .env.local.example; the file-write path already handles that.

Verification

• pnpm exec oxlint dev/local/setup-env.ts — 0 warnings, 0 errors.
• pnpm exec tsc --noEmit --target es2022 --module nodenext --moduleResolution nodenext --strict --skipLibCheck dev/local/setup-env.ts — clean.
• Manual smoke test of the validateUrl helper via node -e against 10 inputs covering valid LAN/Cloudflare-Access/localhost URLs, protocol-less host:port (suggests http:// prefix), wrong protocol (ftp:), garbage strings, whitespace, and #-fragment inputs. All produce the expected ok/error/suggestion result.
• No automated tests exist for dev/local/setup-env.ts in the repo, so the prompt flow itself was not exercised end-to-end.
• Pre-push hook (pnpm format:check, pnpm lint, pnpm typecheck --changes-only) ran clean on push.

Visual Changes

N/A

Reviewer Notes

• validateUrl returns the user's exact input (not parsed.origin) on success, so what you type is what gets written to .env.local. The runtime already derives .origin when it reads APP_URL_OVERRIDE / NEXTAUTH_URL via new URL(...).origin, so a trailing path is harmless — but I chose not to silently rewrite the value. Happy to normalize to origin (reject paths/queries) if you'd rather enforce the strict origin form.
• The "use default / clear" recovery option always returns ''. The caller maps '' to the appropriate fallback: empty for BASE_URL (unset), the shown default for NEXTAUTH_URL (base URL or http://localhost:3000). So one recovery path serves both prompts.
• The validator's "suggest http://" path only fires when the input contains no ://. It does not try to fix typos like htttp:// or missing single slashes — those surface as a parse error with a re-enter prompt.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 files)

• dev/local/setup-env.ts

---

_{Reviewed by grok-4.6 · Input: 120.8K · Output: 21.3K · Cached: 246K}

_{Review guidance: REVIEW.md from base branch main}

[IamCoder18]

Ready for review!