Harden Vitest backend env isolation for v0 project config parity

[Copilot]

Canonical issue

Linked automatically by the system.

Outcome

This PR closes a project-file gap where NEXT_PUBLIC_* backend URLs could leak from shell/CI into web tests, causing non-hermetic behavior despite local test defaults.
Result: web route tests now stay deterministic under v0-style environment configuration.

Scope

• Included:
  • Vitest env pinning: set NEXT_PUBLIC_BACKEND_URL and NEXT_PUBLIC_API_URL to '' in /apps/web/vitest.config.ts (alongside existing BACKEND_URL pin).
  • Regression guard: extended /apps/web/src/__tests__/test-env-isolation.test.ts to assert both NEXT_PUBLIC_* backend env vars are blank by default.
  • Example snippet:

    env: {
      BACKEND_URL: '',
      NEXT_PUBLIC_BACKEND_URL: '',
      NEXT_PUBLIC_API_URL: '',
    }

• Explicitly excluded:
  • Production runtime behavior changes
  • API contract changes
  • Dependency or build pipeline changes

Risk

• Risk level: low
• Failure mode: tests may fail if future config intentionally relies on ambient NEXT_PUBLIC_* backend vars.
• Rollback: revert the two touched files (apps/web/vitest.config.ts, apps/web/src/__tests__/test-env-isolation.test.ts).

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests
• Required CI
• Review threads resolved

Production evidence

Not applicable: change is limited to test configuration and test assertions.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Update project files #1681

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 11:25pm UTC

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA b8aab2d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[Copilot]

🟢 Approved

The changes are narrowly scoped to test configuration and add a matching regression guard, with no production behavior impact and clear alignment to the stated hermeticity goal.

Pull request overview

This PR hardens apps/web Vitest hermeticity by ensuring NEXT_PUBLIC_* backend URL environment variables cannot leak in from a developer shell or CI, aligning test behavior with v0-style project configuration and keeping route tests deterministic.

Changes:

• Pinned NEXT_PUBLIC_BACKEND_URL and NEXT_PUBLIC_API_URL to '' in apps/web/vitest.config.ts (alongside existing BACKEND_URL pin).
• Extended the env isolation regression test to assert both NEXT_PUBLIC_* vars are blank by default.

File summaries

File	Description
apps/web/vitest.config.ts	Blanks NEXT_PUBLIC_* backend env vars during Vitest runs to prevent ambient leakage.
apps/web/src/tests/test-env-isolation.test.ts	Adds regression assertions that NEXT_PUBLIC_BACKEND_URL and NEXT_PUBLIC_API_URL are pinned to ''.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.