[ianriizky]

Summary

• Add NEXT_PUBLIC_LIVE_WS_PUBLIC_URL env var so the live dashboard WebSocket client can connect via a custom domain (reverse proxy / Cloudflare Tunnel) instead of the hardcoded ws://hostname:20129.
• Add LIVE_WS_ALLOWED_HOSTS env var documentation to .env.example for LAN/Tailscale hostname-based origin allow-listing (already used in src/server/ws/liveServerAllowList.ts but not documented).
• Add ai_features scope to GitLab Duo OAuth env setup instructions in .env.example.

Validation

• npm run lint
• npm run test:unit
• npm run test:coverage
• Coverage is still >= 60% for statements, lines, functions, and branches
• SonarQube PR analysis is green or any remaining issues are explicitly documented below

Tests Added Or Updated

• tests/unit/live-ws-public-url.test.ts (new) — 3 test cases:
  • Handshake response includes publicUrl when NEXT_PUBLIC_LIVE_WS_PUBLIC_URL is set
  • Handshake response includes null publicUrl when env var is unset
  • WS_PROTOCOL.live includes publicUrl field

Coverage Notes

• src/hooks/useLiveDashboard.ts — getDefaultWsUrl() now reads NEXT_PUBLIC_LIVE_WS_PUBLIC_URL first. The new branch is covered indirectly by the handshake endpoint test (which reads the same env var). The function itself is not directly unit-tested because it's a non-exported function in a "use client" module; existing behavior is preserved via the fallback path.
• src/app/api/v1/ws/route.ts — new publicUrl field is covered by tests/unit/live-ws-public-url.test.ts.
• .env.example — documentation-only changes, no coverage impact.

Reviewer Notes

• No server-side changes required — the /live-ws upgrade proxy already exists in scripts/dev/standalone-server-ws.mjs(shipped as server-ws.mjs in production builds via scripts/build/assembleStandalone.mjs). It performs a raw TCP forward from port 20128 to port 20129, preserving all headers including Cookie and Origin.
• Cookie auth works through the proxy — auth_token cookie is forwarded verbatim, so isDashboardCookieAuthenticated() in liveServer.ts validates normally.
• Origin allow-list still applies — operators must set LIVE_WS_ALLOWED_ORIGINS to include the public origin (e.g. https://ws.my-ai.com), otherwise the Origin check in liveServer.ts will reject browser connections. This is documented in .env.example.
• Backward compatible — when NEXT_PUBLIC_LIVE_WS_PUBLIC_URL is unset, getDefaultWsUrl() falls back to the existing ws://hostname:20129 logic. The new publicUrl field in the handshake response is additive (null when unset).

Architecture

Browser (wss://ws.my-ai.com/live-ws)
    ↓
Cloudflare Tunnel / Reverse Proxy
    ↓
localhost:20128 (Next.js + standalone-server-ws.mjs)
    ↓ proxyLiveWs() — raw TCP forward, path /live-ws
localhost:20129 (Live WS server)

Configuration Example

NEXT_PUBLIC_LIVE_WS_PUBLIC_URL=wss://ws.my-ai.com/live-ws
LIVE_WS_ALLOWED_ORIGINS=https://ws.my-ai.com

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[diegosouzapw]

Thanks @ianriizky — your work is now merged into release/v3.8.43 via #5878, with your commit authorship fully preserved on all commits. Your fork has "Allow edits by maintainers" disabled, so we couldn't push the pre-merge fixes to this branch and landed it through a mirror PR instead.

What was adjusted on top of your commits before merging:

• NEXT_PUBLIC_* vars are inlined at build time, so prebuilt Docker/npm installs would never see the env — the handshake response now exposes publicUrl (computed at request time) and useLiveDashboard consumes it before connecting.
• Added ws:///wss:// scheme validation on both server and client.
• Fixed the third test case (it asserted a module-frozen const against an env set after import) and added scheme-validation cases.
• CHANGELOG entry credits you.

Closing this PR since the code shipped via #5878. For future PRs, targeting the current release/* branch and enabling maintainer edits makes it possible to merge your PR directly. Thanks for the contribution — the LIVE_WS_ALLOWED_HOSTS documentation was a nice catch too!