From 43ce15ae11a455c05806a45d62e3964571750046 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 8 Sep 2026 22:55:09 +0000
Subject: [PATCH 1/2] Initial plan


From b8aab2d6b49471b8da9aa4eb36d94c872ac1315a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 8 Sep 2026 23:24:43 +0000
Subject: [PATCH 2/2] test(web): enforce blank NEXT_PUBLIC backend vars in
 Vitest env

Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
---
 apps/web/src/__tests__/test-env-isolation.test.ts | 7 +++++++
 apps/web/vitest.config.ts                         | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/apps/web/src/__tests__/test-env-isolation.test.ts b/apps/web/src/__tests__/test-env-isolation.test.ts
index 7ed06572a..ab108c546 100644
--- a/apps/web/src/__tests__/test-env-isolation.test.ts
+++ b/apps/web/src/__tests__/test-env-isolation.test.ts
@@ -42,4 +42,11 @@ describe('test environment isolation', () => {
     // frontend-only mode, which is what the suite asserts against.
     expect(process.env.BACKEND_URL ?? '').not.toMatch(/^http/);
   });
+
+  it.each(['NEXT_PUBLIC_BACKEND_URL', 'NEXT_PUBLIC_API_URL'] as const)(
+    'pins %s to a blank test default',
+    (key) => {
+      expect(process.env[key]).toBe('');
+    },
+  );
 });
diff --git a/apps/web/vitest.config.ts b/apps/web/vitest.config.ts
index b29facb8e..998b003a1 100644
--- a/apps/web/vitest.config.ts
+++ b/apps/web/vitest.config.ts
@@ -29,6 +29,8 @@ export default defineConfig({
     // a key set it explicitly in their own setup, so a blank default is safe.
     env: {
       BACKEND_URL: '',
+      NEXT_PUBLIC_BACKEND_URL: '',
+      NEXT_PUBLIC_API_URL: '',
       BILLING_COOKIE_SECRET: 'test-billing-cookie-secret',
       AI_GATEWAY_API_KEY: '',
       VERCEL_AI_GATEWAY_API_KEY: '',